50e0506456c77045a62ecd764809b4d009ed33586328c56d2be620a18032d4bd

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:26

Target

257b204c0a55ef2437e1f9665b4e235d.dll
Size

32KB
MD5

257b204c0a55ef2437e1f9665b4e235d
SHA1

afbd79c1ed61e46862a7f4e2e3559e3b61e791f6
SHA256

50e0506456c77045a62ecd764809b4d009ed33586328c56d2be620a18032d4bd
SHA512

2d3794a771a4d78287fdc4874cffa44eaee1391d9170d75faef1dc8b651ed9ccbbd07bf180ed23920b32a3bfa24d23bea8b88683f91057b0a5500ab4690a18d5
SSDEEP

384:2puj39NfuKDQ/BFgbpoVCl8zjOvyzJW77+1O+qXSQG9aFJFrRCRNYY4p:cujru/O2Ml8zCSW7ADMSZ96BURNYYk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28
PID 2432 wrote to memory of 1948	2432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\257b204c0a55ef2437e1f9665b4e235d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\257b204c0a55ef2437e1f9665b4e235d.dll,#1
  2⤵
  PID:1948