8cbd9ad03fd291768414ea376c03787012c426edda2501f1f731eba6a317e930

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:57

Target

36266b87dea28409dbcb2ae92e3f5fb2.dll
Size

2.7MB
MD5

36266b87dea28409dbcb2ae92e3f5fb2
SHA1

8eeb3e39eba72f6b2e294c03e4b92134e49040b6
SHA256

8cbd9ad03fd291768414ea376c03787012c426edda2501f1f731eba6a317e930
SHA512

da98565c9e83066694e533f67d23b28f0632b02e21bad554db78062e76e00405f1ab93a49d293955ca9f725e34b5347352ca772997ded67f6dbd068c9e097e83
SSDEEP

49152:xV9Y+y9Y+K9Y+w9Y+y9Y+c9Y+y9Y+m9Y+O9Y+K9Y+q9Y+O9Y+W9Y+69Y+29Y+M9T:D1y1K1w1y1c1y1m1O1K1q1O1W16121Mh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28
PID 2220 wrote to memory of 2352	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36266b87dea28409dbcb2ae92e3f5fb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36266b87dea28409dbcb2ae92e3f5fb2.dll,#1
  2⤵
  PID:2352