dda27747fe60e9ecb593db810a6dbdbc260090aec595a7f153424e3909de363b

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:40

Target

0422868e1598bb1e29684a964cd4b000.dll
Size

116KB
MD5

0422868e1598bb1e29684a964cd4b000
SHA1

2c02f92098ac4d7da41fadbde7b58fe95ad8d7f8
SHA256

dda27747fe60e9ecb593db810a6dbdbc260090aec595a7f153424e3909de363b
SHA512

ce324fbcd7b4a8d3589846fa0864ac3b3cb19f377afd203a8b7bd76c4c5889a34bde4b838477926fa147c6b3a7396ef4458cbbf54c9d2f2f3199336b556909ea
SSDEEP

1536:YMcChs+h6fGzrUi5DyAJguY7J4bVmlC8E5wArxl2WrQoQ6MZiCOTB:YMIq6fw5FJguYaL5VxkWrQosZiCS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28
PID 2008 wrote to memory of 2540	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0422868e1598bb1e29684a964cd4b000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0422868e1598bb1e29684a964cd4b000.dll,#1
  2⤵
  PID:2540