29828dee79dc20847ee00ce0cacea333485270b0fd3cc7e03ed6ce2e384428a4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:32

Target

6ec8108b351c0766f4a04ec7aa4b37bb.dll
Size

92KB
MD5

6ec8108b351c0766f4a04ec7aa4b37bb
SHA1

3225e298f344b290ef3340b6d66498339c2adefe
SHA256

29828dee79dc20847ee00ce0cacea333485270b0fd3cc7e03ed6ce2e384428a4
SHA512

3759cf849f532b464ec3d1c6d7624cf46f978659978b81a3dd77dc7b3728bdfd8249207df1b1d43a01156d58a9cbc62912603d924b3086935e2fedc6b932ea2f
SSDEEP

1536:37BcvfaiPAlGewIrMifHM1x431M5d4e8qu/E6BRLuFVQTuLpIfUJ:3Nc6BlGewIrV44FM5Oe8qutUFyuWsJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14
PID 1732 wrote to memory of 1752	1732	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ec8108b351c0766f4a04ec7aa4b37bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ec8108b351c0766f4a04ec7aa4b37bb.dll,#1
  2⤵
  PID:1752

memory/1752-0-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download