8e67ca48a50d9e24d14f7ea3aa509fd1e59c2abd393a2b65a79376aa44913678

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:12

Target

2fefc2ef8c42f0af76df1d2d7ac32676.dll
Size

25KB
MD5

2fefc2ef8c42f0af76df1d2d7ac32676
SHA1

c3e7261e800f0e3f0e6b15d04b7047260537e447
SHA256

8e67ca48a50d9e24d14f7ea3aa509fd1e59c2abd393a2b65a79376aa44913678
SHA512

b1657810760b70ab1d82cf96c84b85fc21ee7d71a12932db59e12da147dbb8352d21bda655be3a4cb5a97524cf340a0b48a907d4a9d91a519ec19258d635c7a2
SSDEEP

384:I6Q4iW4NuaztttavknvDClfd177bI9CnqD2Y6awzfaRrIiG:q4ZazttXvDCf17g9CqD56hzyRrIiG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28
PID 1708 wrote to memory of 2504	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fefc2ef8c42f0af76df1d2d7ac32676.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fefc2ef8c42f0af76df1d2d7ac32676.dll,#1
  2⤵
  PID:2504