eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:23

Target

Lenin_Script/dll/dlls.dll
Size

52KB
MD5

2a62b6205d28c98da5ed0fe2a9e09abe
SHA1

51ec112c5e43d6ad083330a638deda6917c55aa1
SHA256

394e8de908cecc40638ff20c3ac14b7f81dcaf636d5b687f24329b71b3e8935f
SHA512

dcbf4f347fc8f03c7311a0833e14f5b6aecd7f0c2c31a55fb8bc6c339be348fc91c2b801eb7dc4be36faa0f62d007da06950fc5e4e7bcbbf1b0a5bc9e1fd98bb
SSDEEP

768:CVXqYKk3DTHtNSIwd3W/Prr5jEjxSwRgbN4jzCpmGHtKQMCCH4iFwG+tV:yXqYKiHtAGXfZwRONsMmGHyH4uwv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28
PID 2536 wrote to memory of 2892	2536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\dlls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\dlls.dll,#1
  2⤵
  PID:2892

memory/2892-0-0x0000000000190000-0x00000000001A2000-memory.dmp

Filesize
72KB

Download