a21b428be10d938f3d753904ec14751ff27ab37f78bfb8f8d9309a4ca76c03db

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:09

Target

13f5824d6f9ffbc481b80ebe90604051.dll
Size

25KB
MD5

13f5824d6f9ffbc481b80ebe90604051
SHA1

71e3b5d06e18a71508a37790e05d0db0f9e4743c
SHA256

a21b428be10d938f3d753904ec14751ff27ab37f78bfb8f8d9309a4ca76c03db
SHA512

b41793306dc41f54e70eaa0bc72a7c97621857ce945cd224f1eead71f746b2773d58aca0b4a458f6baa3588f5ee5b2e0bf8dfc513057117971f72a0ca92b59a1
SSDEEP

192:nZ8FL2HlWv2IdSLy4VOMqfaGWa10NIQNNwLiQ7Sss1NaAExoQOwhCuSHDPLNU8rq:2RdCyfMqlW2mQmBN4oQOOLakqAzrXBB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16
PID 2512 wrote to memory of 1520	2512	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13f5824d6f9ffbc481b80ebe90604051.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13f5824d6f9ffbc481b80ebe90604051.dll,#1
  2⤵
  PID:1520