d55336cd15636005434de2e810423dd0d42d8a9e02092bbca3383d2cbee6f3e7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:01

Target

13a066df2715ae0906aa1ce316c26940.dll
Size

841KB
MD5

13a066df2715ae0906aa1ce316c26940
SHA1

fc2f8acdf69a69759f01b1ad75123fa48f1d37da
SHA256

d55336cd15636005434de2e810423dd0d42d8a9e02092bbca3383d2cbee6f3e7
SHA512

e9def2e7e4955c234b1a03aba8278c7a7e56ef8e76fa627d854730e564b7b28bcd3f043cb27f714018206c4487db50652eb0c26c031f4ddf48fa81eb4f71ddc1
SSDEEP

12288:Uyt96bqph7uX6HNvEELjiRiJD7uotsTLiloQNSnSuvtRsyyk:Uy+2h7dvB5JD7JtsTLjKSnHr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28
PID 3012 wrote to memory of 2684	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13a066df2715ae0906aa1ce316c26940.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13a066df2715ae0906aa1ce316c26940.dll,#1
  2⤵
  PID:2684