47cff82a82bc56c6df09399d1a8daf05d997c0696d693359a7c7fe616754014b

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:08

Target

4b9859f459ea6e823907dc124f47620a.dll
Size

144KB
MD5

4b9859f459ea6e823907dc124f47620a
SHA1

3304fed8fb8bee6e64f1f583e55b390284c7f953
SHA256

47cff82a82bc56c6df09399d1a8daf05d997c0696d693359a7c7fe616754014b
SHA512

aec705744eabd785f178f2bfd488dbc419bc1c7b45b61e74b4b08b2071ccb965cfc912014ff67b1c2f0ad22cc73fe2dd4e0dc559b62dd9cdf3bf6b325325bf57
SSDEEP

3072:+VKwMCY/bzuZpbfmpVKxgsIRZzGGijqEulGeG3z9N4:+VKwtY/mvqV5/jXijhulGeG3z34

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16
PID 2392 wrote to memory of 1896	2392	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9859f459ea6e823907dc124f47620a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9859f459ea6e823907dc124f47620a.dll,#1
  2⤵
  PID:1896