5aa5f459b81a74a938da61ebb4068f215d26520ba210aa69c18795ae6ce7330d

Analysis

max time kernel
22s
max time network
20s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:32

Target

012898a4416370d0ccd2ed8aecbc2c6f.dll
Size

55KB
MD5

012898a4416370d0ccd2ed8aecbc2c6f
SHA1

4154eff4713a836088034212927e27cf8b966806
SHA256

5aa5f459b81a74a938da61ebb4068f215d26520ba210aa69c18795ae6ce7330d
SHA512

ec2df983a26fb82c9f536b1f325bdc50b1c638e07c7506fdb0f4e31ba0532b14212520ba8bf7d62e08aaacc0a4255f4f9717baf41fe5e2661fa82a27a1424f3a
SSDEEP

768:XxjDQp6DsOfL62l8ovOh1QlLonIqbq3VkzSwNLo/mj+P11JuHgJ/qydn6j7PT940:BfQAl+7ovOh1RnIq2emwNLoL3TJiSUZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27
PID 2980 wrote to memory of 2324	2980	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\012898a4416370d0ccd2ed8aecbc2c6f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\012898a4416370d0ccd2ed8aecbc2c6f.dll,#1
  2⤵
  PID:2324

memory/2324-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download