fd1e96e20ca5896e520ca7e9c6da6789b11667424453ad9e03b27c618ec00eb4

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:15

Target

24afd5783d74142a7da97e5b328f407b.dll
Size

152KB
MD5

24afd5783d74142a7da97e5b328f407b
SHA1

93ac8149654b60c608a3c9ee8b3e9eb6370651bf
SHA256

fd1e96e20ca5896e520ca7e9c6da6789b11667424453ad9e03b27c618ec00eb4
SHA512

6220e0097705528a883920bc81c4cf8b7b1e34129af68c5f3b9ea1451b993b0672804e1df05abeecc7559ef94358fc8e06fd7f9ec000390b8b5cf64f50767a1d
SSDEEP

3072:5kU2f5imM1aX1vrGmaDwfT7294Z6ScDh5G5galRQQyWlOQ/:5kU2AmSaXVGmicU4T6fYgTWlOQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28
PID 2420 wrote to memory of 2360	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24afd5783d74142a7da97e5b328f407b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24afd5783d74142a7da97e5b328f407b.dll,#1
  2⤵
  PID:2360

memory/2360-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2360-0-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/2360-5-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/2360-6-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download