e08c12cd10311597977fd489b76b57c9f083c4e017394c00252266d236461b34

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:26

Target

051398e041a5614bb5149734d43041bf.dll
Size

112KB
MD5

051398e041a5614bb5149734d43041bf
SHA1

e335f6550cc27c54798b07b558c78878fc7bf065
SHA256

e08c12cd10311597977fd489b76b57c9f083c4e017394c00252266d236461b34
SHA512

2bc97281e8452a203fbedd50e717e7be913c900471ab63a7d5487029fa1c76ee50fe0f39c5b6386af054ed3f17aaea97f72c99a7712ef9a4788794e3062841f3
SSDEEP

3072:JX/VvZy8cwFhnAEzp/KFN/uX8FqxmW5F8U927fwbBF:JXNhy87nAU/K2XKqAW5FyK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28
PID 2000 wrote to memory of 1108	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\051398e041a5614bb5149734d43041bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\051398e041a5614bb5149734d43041bf.dll,#1
  2⤵
  PID:1108