77ec2cb1ed9f30ea478998e3150290168fd229f8de717ecb526b1af06ec3fb86

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:36

Target

004daac951d13e67c59262c25db985e9.dll
Size

198KB
MD5

004daac951d13e67c59262c25db985e9
SHA1

0a82dabe028ef0565a20c2693784ad53acff389a
SHA256

77ec2cb1ed9f30ea478998e3150290168fd229f8de717ecb526b1af06ec3fb86
SHA512

8e889e70306cfe69da3d7fd52286423d8688f9a6c38421c5aa70d6ea1b1582221869a0e8b7a3f2a64b1c34afebfbe51d12426e2bed42e938db79d6416d4f6435
SSDEEP

3072:5Q10/5j01aXteQzWXcvYpMNPmOjmUOImf6OsWunItPR2oNwBZt:5Q1rpMNPvjeI6vpPR2o8Zt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16
PID 2932 wrote to memory of 2088	2932	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\004daac951d13e67c59262c25db985e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\004daac951d13e67c59262c25db985e9.dll,#1
  2⤵
  PID:2088

memory/2088-0-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download