6c785f39e4ae4779a3e4cbc0cc216398f51926bb3a11ec5bfd1534352abaabfa

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:10

Target

4bba508e94d309077e4013f28c96a19c.dll
Size

101KB
MD5

4bba508e94d309077e4013f28c96a19c
SHA1

0bda85454df4e545c5004c85037032229112cdc5
SHA256

6c785f39e4ae4779a3e4cbc0cc216398f51926bb3a11ec5bfd1534352abaabfa
SHA512

66a49dd309561bfa1bba3810e1ed6a23843f3466fe750506c9bf728c84f3cfcb4e3387757e381524b0ba35d80964d96c39a1500a22abdca6c1c69d06585be86e
SSDEEP

1536:mzHTYzlIJg60dxkdIv6jGIfK2pGTEwn1+5r+GBY8UlEj5UENCG:YzAlIJlSyv5u3GB5tj5UVG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28
PID 2140 wrote to memory of 2040	2140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bba508e94d309077e4013f28c96a19c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bba508e94d309077e4013f28c96a19c.dll,#1
  2⤵
  PID:2040