e0e345e077637ad607146b0b9efa39582bbcbb8c9d155e46d3d39038b0704b06

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:21

Target

191b21cf08b32229acae7fa15ad8c659.dll
Size

74KB
MD5

191b21cf08b32229acae7fa15ad8c659
SHA1

8f3107e260211af1af93cbc58fe201b47a131849
SHA256

e0e345e077637ad607146b0b9efa39582bbcbb8c9d155e46d3d39038b0704b06
SHA512

b80e193db9fa24ef961aa0539c03472d83064904ad3cc7d692be6e237dd10e90beaf07ed7c900e7c717badfc9339d4bbd3ccac20adf385076a6861fc31b25726
SSDEEP

768:HHV2l2FCB5rJ8XMneNHV2l2FCB5rJ8XMneNHV2l2FCB5rJ8XMneNHV2l2FCB5rJy:V2lT08ne2lT08ne2lT08ne2lT08n

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14
PID 2132 wrote to memory of 2092	2132	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\191b21cf08b32229acae7fa15ad8c659.dll,#1
1⤵
PID:2092

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\191b21cf08b32229acae7fa15ad8c659.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132