5b920d9879debea24effd832b1f48176a2824023826e481a8448857a9a9262f6

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:41

Target

0f9dda097cde6a275f60f6463b96aa1f.dll
Size

84KB
MD5

0f9dda097cde6a275f60f6463b96aa1f
SHA1

3ef2a3de6b89654e9c7a2bf4ba344bf40e92e0f0
SHA256

5b920d9879debea24effd832b1f48176a2824023826e481a8448857a9a9262f6
SHA512

cd096eca97dd21b62609d4be97a481b4a29fcd1c260b48f02454eabb58e250a85f5f122806bb9207063627ad15781d6d7064fde5dd277d690ce2b17a61cfe3fe
SSDEEP

768:MaFJam9WkwsbWRtzGFHGvh/Lk9xWKZlZJgJw0vZqBee/0qeXRpt1R9X760ALdeb:34kwjuHGZ/LURvPgu04X/0qeBpH3UY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14
PID 2108 wrote to memory of 2372	2108	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9dda097cde6a275f60f6463b96aa1f.dll,#1
1⤵
PID:2372

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f9dda097cde6a275f60f6463b96aa1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

memory/2372-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2372-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2372-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2372-0-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download