900e0f8b9e0aac7623544b42b77d2ab1b9421f57ac090fa5a62498b48e77cd79

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:46

Target

358312ec93283b6fa7f84081968521f2.dll
Size

95KB
MD5

358312ec93283b6fa7f84081968521f2
SHA1

baab805bade70cd9b7024b0cb39fa08a44585420
SHA256

900e0f8b9e0aac7623544b42b77d2ab1b9421f57ac090fa5a62498b48e77cd79
SHA512

9af6b683e6b5f5c74bd1f01beb32edd4349ad748fcc107d1d53248db805f9d0f1163ce0eb32808c332a8d645abf8c563f6782c15e626fcd4e858719a6445f5dd
SSDEEP

1536:F4oFrx5PIki1hOMc0dP3L2Oe9tL9r/Yb8eIpu8tX79lJojguBKOm:F1lvLi1Hb1Pe919r2J8tXJlCjguBNm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28
PID 3068 wrote to memory of 2076	3068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\358312ec93283b6fa7f84081968521f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\358312ec93283b6fa7f84081968521f2.dll,#1
  2⤵
  PID:2076

memory/2076-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2076-1-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download