47ced2bfd3b5b099d3ee70e4917be52f947cddcfd1c8becc428bd8f19c9671d9

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:42

Target

229fa6904b67fc0cfe652b83343089bd.dll
Size

437KB
MD5

229fa6904b67fc0cfe652b83343089bd
SHA1

b9240c2d253ab26386ac93c578b3c0b6ba2017b0
SHA256

47ced2bfd3b5b099d3ee70e4917be52f947cddcfd1c8becc428bd8f19c9671d9
SHA512

8f79b3b36f32a685f013e7e68a372f4a29460e7e20ea319a330b03bb97e2ce51986e3355d38e5c22fec161ccc8325634a98dfb8b619faf494562a57ff365a934
SSDEEP

6144:U3SrsbB3SeJZWUdgU59z23GvkomNCufNP4WLzOsYCsiing7AcIf5Bv8KMKG:jrquag4z235oWfNP4Wu6grcUnvd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28
PID 2232 wrote to memory of 2136	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\229fa6904b67fc0cfe652b83343089bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\229fa6904b67fc0cfe652b83343089bd.dll,#1
  2⤵
  PID:2136

memory/2136-0-0x00000000001F0000-0x0000000000255000-memory.dmp

Filesize
404KB

Download
memory/2136-1-0x0000000000270000-0x00000000002E0000-memory.dmp

Filesize
448KB

Download
memory/2136-6-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2136-5-0x0000000000270000-0x00000000002E0000-memory.dmp

Filesize
448KB

Download
memory/2136-8-0x00000000001F0000-0x0000000000255000-memory.dmp

Filesize
404KB

Download