16dc54abc6a05f145ecc12884c67286fd8e925c990907ee42cb962a1466bb9b8

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:50

Target

1fd0b996dcdc4124c62254797c689a00.dll
Size

94KB
MD5

1fd0b996dcdc4124c62254797c689a00
SHA1

8c65bb21744b35514991585da39c07a37fef386f
SHA256

16dc54abc6a05f145ecc12884c67286fd8e925c990907ee42cb962a1466bb9b8
SHA512

bb27cf2460aedef82b6a2b2adfdaed7540ebdefeef4df645a92d3720b40226c70c14d7c57357d35683ee9e21cd91ce5d9ae41c477daec492c76d0e7a1fcac040
SSDEEP

1536:HJiW35/pvcvn2vO7KjUQfTMfnJdkNKgCWQSonKhA68x2WFM4OiCCswRvK:t5/Ncvn2meIQfTMfnHkN9QHHn52tD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28
PID 1204 wrote to memory of 1664	1204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd0b996dcdc4124c62254797c689a00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd0b996dcdc4124c62254797c689a00.dll,#1
  2⤵
  PID:1664

memory/1664-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1664-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1664-2-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1664-3-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download