9a9a08ad1d2c38803ffdbd5dfd50ba47619c4d84d374bfd9f42091acf610853d

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:38

Target

041d3d2900b2dd11a40d34eb28eb9981.dll
Size

44KB
MD5

041d3d2900b2dd11a40d34eb28eb9981
SHA1

3c720988233ab34102acb8ff4a677a4f1d5f2eb0
SHA256

9a9a08ad1d2c38803ffdbd5dfd50ba47619c4d84d374bfd9f42091acf610853d
SHA512

65d5c63503c2e58a43c9a920ac4b6e28dee9e252440365d683ea632dfa3479d1694682c27b702dbeae80d54625e5218fc0b68a6e9e2200905bed1a226b0dfb18
SSDEEP

768:eKKede/qB46qVm6mrl1iHzJA3v45xWbxtQiMWAOe6IAOIjsxIsclsd:eaepjm6uXKv5xSQiMGeVIWIKd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28
PID 3016 wrote to memory of 2248	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\041d3d2900b2dd11a40d34eb28eb9981.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\041d3d2900b2dd11a40d34eb28eb9981.dll,#1
  2⤵
  PID:2248

memory/2248-1-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/2248-3-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/2248-2-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/2248-0-0x0000000000150000-0x0000000000159000-memory.dmp

Filesize
36KB

Download
memory/2248-4-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/2248-5-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/2248-6-0x0000000000040000-0x000000000004E000-memory.dmp

Filesize
56KB

Download
memory/2248-7-0x0000000075530000-0x0000000075640000-memory.dmp

Filesize
1.1MB

Download