68dcfd94605b1072f3c94ba605333ae0637bae1fe84501e5c68676652dd9fb12

Analysis

max time kernel
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:38

Target

5d057ff41a97e980d6a52bd1a6cbda3d.dll
Size

33KB
MD5

5d057ff41a97e980d6a52bd1a6cbda3d
SHA1

323488bcba8d3062e6c3496551ae170962435e10
SHA256

68dcfd94605b1072f3c94ba605333ae0637bae1fe84501e5c68676652dd9fb12
SHA512

24c64f6a4f626aad1d8cf25cc713a3bdc415d69b28dff863e5ef405d574bd2ad9350145bf71d3a0e32e152e8a52262b0a7bb7e89e7e40312d59ec8d643f8b465
SSDEEP

768:/0ceyVVtUn0J4gaed7hB7vrcFDfPta4SqO8dtR8spkU:/0cXVn1ael7vrctfP5R1pX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16
PID 2688 wrote to memory of 3036	2688	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d057ff41a97e980d6a52bd1a6cbda3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d057ff41a97e980d6a52bd1a6cbda3d.dll,#1
  2⤵
  PID:3036