41f5f472d15f67d4cca92de863ef6fcae6d70ec0011f940c4d906bdeb30b57b8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 03:55

Target

0425b4a917e181321b53a28d38846988.dll
Size

48KB
MD5

0425b4a917e181321b53a28d38846988
SHA1

040c0992c30e6f3f450999cd25ea49b663bf51e1
SHA256

41f5f472d15f67d4cca92de863ef6fcae6d70ec0011f940c4d906bdeb30b57b8
SHA512

1bbd5b4e41725d1b89393654bcb2aa4eed54de97fb94742b8096a18bd47b5c517ea7d89894adf58c1bda4230352e2163da97ef99b508c6a7e55a37ed35782a37
SSDEEP

768:OcYLxct1huMx+43zosGdrUZjbgSSI/zMxKUM2Lk1NPIM5cSZ:4xjMo43zAlc97McT75cS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16
PID 2172 wrote to memory of 2284	2172	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0425b4a917e181321b53a28d38846988.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0425b4a917e181321b53a28d38846988.dll,#1
  2⤵
  PID:2284

memory/2284-2-0x0000000077E4F000-0x0000000077E50000-memory.dmp

Filesize
4KB

Download
memory/2284-1-0x00000000000A0000-0x00000000000AE000-memory.dmp

Filesize
56KB

Download
memory/2284-0-0x0000000077E50000-0x0000000077E51000-memory.dmp

Filesize
4KB

Download