f11ad867ee0065d02a093eb680fb0a829eaf1633344dc640b0d8fb6ab2098692

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:05

Target

01cb887b556106dc0c517a7dd067664a.dll
Size

48KB
MD5

01cb887b556106dc0c517a7dd067664a
SHA1

4f026dc962bcb392181ada4fef8503e3022ee527
SHA256

f11ad867ee0065d02a093eb680fb0a829eaf1633344dc640b0d8fb6ab2098692
SHA512

68db9cab4cb5cf5f8c74639b910639a32e0f1010f2d06e7521ed45dc392076956f06a66059b14e6b646878eda0203911faf21839a7e7c68b4bcb157af3c1412c
SSDEEP

768:xkOPxH9zo7QsIZdX7xSCd1yJE2TkjrX8y1D8QQFgNDXzUqchKUqIjB+:x1PxdUU3Zdl/1UfTY/l8PFgdfcIUqqB+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14
PID 2896 wrote to memory of 2224	2896	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cb887b556106dc0c517a7dd067664a.dll,#1
1⤵
PID:2224

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cb887b556106dc0c517a7dd067664a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896

memory/2224-2-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2224-1-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2224-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download