a3e02fc5d99e764268f9446c511942281439881d4bbfd80f4e9d5996da59a3da

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:27

Target

206a792418dfea98d85f34eb0334a59c.dll
Size

53KB
MD5

206a792418dfea98d85f34eb0334a59c
SHA1

0545c59cce60093a8f5abf178c37d55d7a78aa4c
SHA256

a3e02fc5d99e764268f9446c511942281439881d4bbfd80f4e9d5996da59a3da
SHA512

e7618e773f42bb33e0b442900fc4debaf81cdf4a29a890b1f1cf55d2437d8868d9a41138af0369f65d77a750f05d14ec188e9693a63e8627ac9e26b1e4eedd94
SSDEEP

1536:me1x/tOJ2H+DwpQXSNgMAz8AUhc6zcWk6vS:lfIse3MSFUhc6zfLv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16
PID 2184 wrote to memory of 2968	2184	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\206a792418dfea98d85f34eb0334a59c.dll,#1
1⤵
PID:2968

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\206a792418dfea98d85f34eb0334a59c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

memory/2968-0-0x0000000000130000-0x0000000000143000-memory.dmp

Filesize
76KB

Download
memory/2968-1-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2968-2-0x0000000000130000-0x0000000000143000-memory.dmp

Filesize
76KB

Download
memory/2968-3-0x00000000001A0000-0x00000000001B3000-memory.dmp

Filesize
76KB

Download
memory/2968-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2968-5-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download