6c5df68c511b2d48f3715fc1fa97716362a372a142c4fcd2153e372b988fa55a

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:18

Target

66b6d325225d83ef98f8bc1e99298e58.dll
Size

378KB
MD5

66b6d325225d83ef98f8bc1e99298e58
SHA1

ead57b91d6f66fb832e6f7c866e3548505114972
SHA256

6c5df68c511b2d48f3715fc1fa97716362a372a142c4fcd2153e372b988fa55a
SHA512

8bfa4b5e4c28033d854f80906daec24f9f71a282d3457c234c46eaa57f0347a2c8c8558927820d2ce9ea60ee2ef58c5acd44f1956f2827f4925c12f1788ab48d
SSDEEP

6144:kQGnasxIPsYk9kNIzk16ffkurOpbDIgFhXYWXMHJyUooBMpacpVnYrZVxWn60u3V:NGaeIPvQ2KJPcniWgdQsyDS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14
PID 2864 wrote to memory of 2896	2864	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b6d325225d83ef98f8bc1e99298e58.dll,#1
1⤵
PID:2896

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b6d325225d83ef98f8bc1e99298e58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

memory/2896-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download