0ea2e21f1c2bc172a70b037afaf34894516b0e4e9e445863952e9865edd4e1de

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 00:45

Target

474d4a550c69a1d6829b15538e1a35e7.dll
Size

51KB
MD5

474d4a550c69a1d6829b15538e1a35e7
SHA1

e6bebba91fe6479706ed5750754edd85ba692845
SHA256

0ea2e21f1c2bc172a70b037afaf34894516b0e4e9e445863952e9865edd4e1de
SHA512

409f04015c6e8b1d823e5d6d90a761b56060474dad880e4caf59ca630dc1a990924be6d8bc87d37a0445262d33e590fad5652a0caa96c5e513a97fa6adbb406f
SSDEEP

768:0fM30Tl1K3DKyOhk7B/4xZargXOkpgebbTEYBh4QAHK2h0OjiAlWSPjd0VrON4CE:cG0p1MOfi7B/4PsgXNL3/h0KNgJ6lO6n

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16
PID 2248 wrote to memory of 2380	2248	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\474d4a550c69a1d6829b15538e1a35e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\474d4a550c69a1d6829b15538e1a35e7.dll,#1
  2⤵
  PID:2380

memory/2380-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2380-1-0x00000000001B0000-0x000000000025C000-memory.dmp

Filesize
688KB

Download
memory/2380-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download