e07663b0d031aba0b87202ca0b4dde37e5b0ea7b7a7e62b348faa673d65c8e3c

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:51

Target

06abfdd6e0d4a251dd6979261cbfe6fd.dll
Size

320KB
MD5

06abfdd6e0d4a251dd6979261cbfe6fd
SHA1

84ca80825e9f670ce85e6c3238817b7826959a25
SHA256

e07663b0d031aba0b87202ca0b4dde37e5b0ea7b7a7e62b348faa673d65c8e3c
SHA512

4225eccf289903c0e14b8ffdffeae5a8a74070a1f9722b4c4259ddbff17eca7251b2d6d53403ca9e36df81ebda794846b829241df0958159b5dbdf7f7ae84a02
SSDEEP

3072:ON9SXgq+bKDXfpeTVXcRU9sptkrdoikbS9QKJ7LeUjUc6wYAJu3tvzJAlq3APn9k:oWVdpS3t57KMUc9YelqSqviT0j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28
PID 2056 wrote to memory of 2980	2056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06abfdd6e0d4a251dd6979261cbfe6fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06abfdd6e0d4a251dd6979261cbfe6fd.dll,#1
  2⤵
  PID:2980