e060b66885b4431572dc166d703aeec4185a5cb388e21f4219379e09910508b4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:15

Target

58f7de614e56db152175e8407dd1ded2.dll
Size

116KB
MD5

58f7de614e56db152175e8407dd1ded2
SHA1

3f8a0a831cc7d0c1e7797d9d233bbba6b37aba69
SHA256

e060b66885b4431572dc166d703aeec4185a5cb388e21f4219379e09910508b4
SHA512

95ce78e12a7359f7941728a2148d8f275f826dc9ffd95809ee803bfdb465620af5e1f0a361e46a00894d69f660dafd38bd6fd4b68b1a45fbd1a5d80c3a2f202d
SSDEEP

1536:cea1sET+HX4hJx4l7pOe+FhgVk+/MiIjnowxisoOF6aSAalEU:cJK8+HX4hupOReV8iygsow6KalEU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16
PID 1224 wrote to memory of 2156	1224	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58f7de614e56db152175e8407dd1ded2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58f7de614e56db152175e8407dd1ded2.dll,#1
  2⤵
  PID:2156

memory/2156-3-0x00000000001B0000-0x00000000001D3000-memory.dmp

Filesize
140KB

Download
memory/2156-2-0x00000000001B0000-0x00000000001D3000-memory.dmp

Filesize
140KB

Download
memory/2156-1-0x00000000001B0000-0x00000000001D3000-memory.dmp

Filesize
140KB

Download
memory/2156-0-0x00000000001B0000-0x00000000001D3000-memory.dmp

Filesize
140KB

Download
memory/2156-4-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download