53a0f3ce661ed042e295499755c814577ccae041911338dbe6417db63939771f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:36

Target

17a9927daccc2d01b4c6b100a335b502.dll
Size

152KB
MD5

17a9927daccc2d01b4c6b100a335b502
SHA1

8afe3150da4715f543e29b40ca722013dd1fda6b
SHA256

53a0f3ce661ed042e295499755c814577ccae041911338dbe6417db63939771f
SHA512

4c2ed86b8a7dde07ee7fa4c927adfee3746bf838ef2b0aa5dcb6c93bed3cdf08394a39ebaba7b25dd66622e1c943940c5b14d54ebab8392ef143bb7719a13e72
SSDEEP

3072:BWdkQkwfiFzJ0MAfiI3hlerzbfRH3upHKjn0D5XaZRIOvpLMxS+1V:B+kwu0MAfiwnerzbf13BjnM0Izo+1V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17a9927daccc2d01b4c6b100a335b502.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17a9927daccc2d01b4c6b100a335b502.dll,#1
  2⤵
  PID:1732