cdb7fa8f53c1be50442fefd29e64ab6b8039771da4ba59c50b0369912deee515

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:11

Target

0512a761897c1a4d7b4a401383d5be57.dll
Size

79KB
MD5

0512a761897c1a4d7b4a401383d5be57
SHA1

465287aaa25202d7acb2da376352714122c6a05d
SHA256

cdb7fa8f53c1be50442fefd29e64ab6b8039771da4ba59c50b0369912deee515
SHA512

20a4b81ab958efd84fa2910cb7c3f3433313eb410ba9285a8b99aef9ee8566244355e8c05936fc792d0741d13a715aeaa4a48a608496dffef43ba63b40f4364d
SSDEEP

768:lU8jy694/7LsWkFMalLepofSEtkU5yXNkOhPpEniteDH/J6/Wfed76n2YEDZ4w4N:bWuKk3lIo8kCanqeV1fwCggI0H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9
PID 1212 wrote to memory of 1700	1212	rundll32.exe	9

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0512a761897c1a4d7b4a401383d5be57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0512a761897c1a4d7b4a401383d5be57.dll,#1
  2⤵
  PID:1700