5bac478feaae922d4d369a1cf30ade9100e79d9e52ebfb67a63167ce4bb777fa

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 15:28

Target

5bac478feaae922d4d369a1cf30ade9100e79d9e52ebfb67a63167ce4bb777fa.dll
Size

2.0MB
MD5

95f8b75a3ad77a61ce177af356e5e129
SHA1

75a846757e435426a1a7a6d40cab088771da1463
SHA256

5bac478feaae922d4d369a1cf30ade9100e79d9e52ebfb67a63167ce4bb777fa
SHA512

8d93b22e3b6e7028760380e2dea67e5517cc840d0a4f0e59d17077bfb4aaaca4c530bd4e7d5c937955a8289fcb39baadfc82c6a23c3abf6febe86c65ac3b4d9a
SSDEEP

24576:cYG7K9TL9iSQCDv8ivLDgpYpk9MRS+MbMGAPG4tBRwLs57kcJrVhW4LfmiMg9fvJ:cNe0JCDCpmqOSBjLsrJpNzmLg9fvwjw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28
PID 2052 wrote to memory of 2104	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bac478feaae922d4d369a1cf30ade9100e79d9e52ebfb67a63167ce4bb777fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bac478feaae922d4d369a1cf30ade9100e79d9e52ebfb67a63167ce4bb777fa.dll,#1
  2⤵
  PID:2104