e2d75aa2ddcd0c09460ab0a0fc488a5ebabd8f025768ab83db5fd007af602a9a

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:20

Target

45f223021bf18640c65812c8d7e25ebd.dll
Size

93KB
MD5

45f223021bf18640c65812c8d7e25ebd
SHA1

13921bcba1431b1dc9b9a75d4eb72720f1f003f6
SHA256

e2d75aa2ddcd0c09460ab0a0fc488a5ebabd8f025768ab83db5fd007af602a9a
SHA512

d7606f3e63d8b38a20861a041f5d6560932fe9afed6e0840f1c646220d889a22a17fef248b6ed772216b018a22a2b0823c00e383371b4dc438255a0ca4463dc3
SSDEEP

1536:ED5U+m70e9otXAwkFB+gA14VPySgXoLFRtJQ9IxsWyk4/F40cOHRZIIK8QCu6:kq0eCaUgRZy5Xc89IZC/FtRZvKsu6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18
PID 1956 wrote to memory of 2132	1956	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45f223021bf18640c65812c8d7e25ebd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45f223021bf18640c65812c8d7e25ebd.dll,#1
  2⤵
  PID:2132