5ea09381e47926fda2b92e4d5fe18ad4203b7cafb6863894de4cfe4d15f80f24

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 02:10

Target

4bbb3f49af1961dceaefbd2b2f14c640.dll
Size

7KB
MD5

4bbb3f49af1961dceaefbd2b2f14c640
SHA1

0948b2499d8ac79cbeac9f28ffe149a411c51ea4
SHA256

5ea09381e47926fda2b92e4d5fe18ad4203b7cafb6863894de4cfe4d15f80f24
SHA512

22198a012e49e457bb1e0da2d65041e01b0a8416bac9cc3cd0854d0183c5b9235e1db8ee3dae17145d70d699c64a43ac9a0904e743adca4597ac71846ddf1a3c
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWfbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPxq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28
PID 2336 wrote to memory of 1068	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bbb3f49af1961dceaefbd2b2f14c640.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bbb3f49af1961dceaefbd2b2f14c640.dll,#1
  2⤵
  PID:1068