30b1457a43360850dd021bd17432c63b4988fdeae55e0fb5f393060ba1800e92

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:43

Target

6f6626a671024650ed01a1c2311f1b08.dll
Size

85KB
MD5

6f6626a671024650ed01a1c2311f1b08
SHA1

3600f9c3effc7cfebb78beb13b7e031a2d0a13db
SHA256

30b1457a43360850dd021bd17432c63b4988fdeae55e0fb5f393060ba1800e92
SHA512

e54a3e2ca197b7ba63b8c0d11ff81bcf648711cf507cac923e18c63cd945e876cc42bde75ce2dea712e52b9b290d629ec07ba0cd8e2388a47b63d1038dd9b541
SSDEEP

1536:t5Zd1CG33MD2mmg29+2Oa0OYziAha31N2cqHk5LVxxqpQjYw44A7wcRAP5i7Di1B:93Bn/R9+jYY7+wHmxxQMYw44AscRs29Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28
PID 1520 wrote to memory of 1792	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f6626a671024650ed01a1c2311f1b08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f6626a671024650ed01a1c2311f1b08.dll,#1
  2⤵
  PID:1792

memory/1792-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1792-1-0x0000000000110000-0x000000000011F000-memory.dmp

Filesize
60KB

Download