bdd31cbd2f6ca883e86bea2406e1f1f7fbe2f595435989ffc2623129644c627a

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 03:24

Target

500f27d26dfdb8ec572ae53ad801b097.dll
Size

310KB
MD5

500f27d26dfdb8ec572ae53ad801b097
SHA1

c29ffd457a8a2b89b356e7017820968c454b6604
SHA256

bdd31cbd2f6ca883e86bea2406e1f1f7fbe2f595435989ffc2623129644c627a
SHA512

1622c947bcb70d90fd9c460407c6713d880587e78e28f7ce93ed2f7dc63276f05a71252577679ff88915eba0271431b277eae9bf129b394ef1f27476e13aee40
SSDEEP

6144:D4cy45At4I5gWk6kA8VG7QNFviT+cBjvjOPxmmZKrMkIqgNI0gQT7OW58W:DnNIaF6kvLN5irjZmkrMr1mQTaWH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28
PID 2656 wrote to memory of 2244	2656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\500f27d26dfdb8ec572ae53ad801b097.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\500f27d26dfdb8ec572ae53ad801b097.dll,#1
  2⤵
  PID:2244

memory/2244-1-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download
memory/2244-2-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download
memory/2244-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download
memory/2244-3-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download