6b0731f45ed2ba2456103d2a7c444327b1d4fcee64dee10b36ab5a0543947373

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:07

Target

4239d46d22d7b4c9ab9b29e7f7d27abc.dll
Size

172KB
MD5

4239d46d22d7b4c9ab9b29e7f7d27abc
SHA1

6ebdbfb0f2acee6c1b0b84dc75c391787f78f719
SHA256

6b0731f45ed2ba2456103d2a7c444327b1d4fcee64dee10b36ab5a0543947373
SHA512

67d4ff3a81f5f39891821d8b99f47bda3fd00c691145dbf0d3155988879b90ca0da0c6e3a26f29ae9e193220413e25eb9d18c34230739c4c008e34b08ab75a40
SSDEEP

1536:Mb4uSvl91pVoNby69ni3xGnMXY0xB6JNvWtk2vp8eNOYw54YQL+urgVd7RR1LAf/:U6p2JihGAsJ4tk2+2yW07BLADtxD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28
PID 1540 wrote to memory of 1228	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4239d46d22d7b4c9ab9b29e7f7d27abc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4239d46d22d7b4c9ab9b29e7f7d27abc.dll,#1
  2⤵
  PID:1228