16b2acfed919c5cf3dcfc898219769505ea9c3dfb3823b6c44ca5eb8b406cdba

Analysis

max time kernel
118s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:09

Target

13fc37c068683cdd9aee94b4b9085911.dll
Size

61KB
MD5

13fc37c068683cdd9aee94b4b9085911
SHA1

ca68ca958d61cff613ec17eb54f909b7b530246f
SHA256

16b2acfed919c5cf3dcfc898219769505ea9c3dfb3823b6c44ca5eb8b406cdba
SHA512

fb2b375b241605feb748891f0f7c18553cf620c7ab391c9ea22e61bd9c72bd1349f2b2860dc460195cb02821964379ccc5b3fb68ab2d7071453d00c476754dcf
SSDEEP

1536:V8O9Nn6RjriwVyW6iJjw6aJxqYWuTBs5NzcEGnfdLvq927P3:2Oz6VWQ0kcRgwfBnr3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29
PID 1952 wrote to memory of 1664	1952	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13fc37c068683cdd9aee94b4b9085911.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13fc37c068683cdd9aee94b4b9085911.dll,#1
  2⤵
  PID:1664

memory/1664-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1664-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1664-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1664-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download