e267340b1eba536dede221322869507ef5d85c069b959a238586942b657aa039

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:11

Target

0329e4f489bf2eeedaf8e904bbf92e0b.dll
Size

60KB
MD5

0329e4f489bf2eeedaf8e904bbf92e0b
SHA1

f330eff35d7ec52e3e835f99328edb289618d79f
SHA256

e267340b1eba536dede221322869507ef5d85c069b959a238586942b657aa039
SHA512

4d801e8e377e7034db8676b12216e53c55226d08e78753e53f3f1890814ac549fc9b3dbb340b35a9c69f48a65027d462a79e98fb8430e74da97a536b33b0adfb
SSDEEP

768:N/Fa7kSKWbcE/mFOQGeBuzZ/4MARSd5uPkF0AAssYN:N/Fa7kSJcQeW8uzZ/4Mr+6AZk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28
PID 1988 wrote to memory of 1920	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0329e4f489bf2eeedaf8e904bbf92e0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0329e4f489bf2eeedaf8e904bbf92e0b.dll,#1
  2⤵
  PID:1920

memory/1920-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1920-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1920-2-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download