e6b744633582192c63c3699e9265f810f18cfa959d7719e4b81154837126e414

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:47

Target

021acb4c039274d3bee467a7f543f6fb.dll
Size

336KB
MD5

021acb4c039274d3bee467a7f543f6fb
SHA1

9aaf1f7a344f544d13405f64194e6634e4e2015b
SHA256

e6b744633582192c63c3699e9265f810f18cfa959d7719e4b81154837126e414
SHA512

29dee83f75c95067911811e395184e579c294144f6d980dd32042cc18d5c3c7e6e78e6537a721d6ca65eae2f1920ec06519e86a3075cdee2b76b7116a0aa3353
SSDEEP

6144:5pMewwLP6kr3nCkTzJ67Jd6IgP3AR9CJOtbILnagXCmsV69X:nM8tzRFIgP3AnqDZX8E9X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28
PID 2000 wrote to memory of 2016	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\021acb4c039274d3bee467a7f543f6fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\021acb4c039274d3bee467a7f543f6fb.dll,#1
  2⤵
  PID:2016

memory/2016-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2016-1-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2016-2-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2016-3-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download