c5773d87542b9e0ab138d483894fb69c5e524ea6a2609555f87d32f291bfd54b

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:48

Target

11e93b5ce7835fb8a69ec0f98828caa0.dll
Size

8KB
MD5

11e93b5ce7835fb8a69ec0f98828caa0
SHA1

5538cea0a1aed5426a0e7e26e66ffe6cba9da0dc
SHA256

c5773d87542b9e0ab138d483894fb69c5e524ea6a2609555f87d32f291bfd54b
SHA512

79c0abe91e928e583c838ee3c89534e5698968fdda95ebc2c6ae305c65a7b501a1e69339287314137fa3cd64592a0f4771973c65c4b339b32774f95738298bf2
SSDEEP

96:tAG0z/lPlNr092UYpAbpzw8Wt52WDxTCGeEQjIQOrj+kqvyU5S:8FlNr092U+Abe848arj9qqU5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28
PID 2952 wrote to memory of 2960	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11e93b5ce7835fb8a69ec0f98828caa0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11e93b5ce7835fb8a69ec0f98828caa0.dll,#1
  2⤵
  PID:2960