f8d4693156e2467233ee02487820a4eefe1ba539ce25329a4767855cfe2e709b

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:27

Target

258c799d72958bf08744e60ca0252daf.dll
Size

156KB
MD5

258c799d72958bf08744e60ca0252daf
SHA1

464a977eee6fa9eca62f2835fb21e1e0b52c112f
SHA256

f8d4693156e2467233ee02487820a4eefe1ba539ce25329a4767855cfe2e709b
SHA512

0848ae31f06dde829539b846cfefb35628672c2d2ee8fdf3ebf4288f045e73b1249b8d66f595075901d95b6c9da018ec6040b9f69b397e778d80904fa9c4b2d4
SSDEEP

3072:Oeka1bYKHueiKk+GfCxGg+btFKHZawvCd2bP6atIsCF7ZMtcKo:JbniP+GfTgYm1CLsC/Me

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28
PID 2092 wrote to memory of 2848	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\258c799d72958bf08744e60ca0252daf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\258c799d72958bf08744e60ca0252daf.dll,#1
  2⤵
  PID:2848