29ef138a30749b1ed8f299c92cf4639e8c5990faeb5b147410e48e3765e26cd6

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:37

Target

60457dec0e7d1b0b05d85cfc07562478.dll
Size

1.1MB
MD5

60457dec0e7d1b0b05d85cfc07562478
SHA1

5e880353556434d7d7c3bce95a31b5e0e7daa2d8
SHA256

29ef138a30749b1ed8f299c92cf4639e8c5990faeb5b147410e48e3765e26cd6
SHA512

96fbe190b86735d93ec33c25b98a687ada073cbca63b68fb42940f593627d4e861d11290d3cf78e572c199bcdb2d7fc5344fb37dae178ed05602b29270f2978d
SSDEEP

24576:Qbnfq7fIRgJ+MiQbvlIe5XOBvvEOmaSjnw+82j9WtIAdmXRDtbZF:CfUBJrCqQvfSjnpb9pAwtP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28
PID 2912 wrote to memory of 2972	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60457dec0e7d1b0b05d85cfc07562478.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60457dec0e7d1b0b05d85cfc07562478.dll,#1
  2⤵
  PID:2972

memory/2972-0-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download