046002361ff666d86a6344b8879cf8521b8492fe61804304af4e33b39ce3201d

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:44

Target

269e20178cf67612ac9c4ff8d0b5b579.dll
Size

79KB
MD5

269e20178cf67612ac9c4ff8d0b5b579
SHA1

d756cb42029a2cf4ed486e67eaf36f49f7a62385
SHA256

046002361ff666d86a6344b8879cf8521b8492fe61804304af4e33b39ce3201d
SHA512

633a74ba1df6b88c2c13a485162b21bb25148fe71912f0d806869daa9b2805c8326736b5e05a586812b1c7ef01fde32adbb851c653c701b26af6d472047c908a
SSDEEP

768:f8jy694/7LsWkFMalLepofSEtkU5yXNkOhPpEniteDH/J6/Wfed76n2YEDZ4w47c:UWuKk3lIo8kCanqeV1fwC8ss

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28
PID 3048 wrote to memory of 2916	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\269e20178cf67612ac9c4ff8d0b5b579.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\269e20178cf67612ac9c4ff8d0b5b579.dll,#1
  2⤵
  PID:2916