6fcebb1d5cc87d3feb7ec5b83d00e8c917ee8f65a9f01a29d350173e8bd64c98

Analysis

max time kernel
97s
max time network
34s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:05

Target

70c5716cec4941850e291dceb1d5216c.dll
Size

240KB
MD5

70c5716cec4941850e291dceb1d5216c
SHA1

4e52eb92bb1bb27c7243f6ccb5f0aebc549bc9a1
SHA256

6fcebb1d5cc87d3feb7ec5b83d00e8c917ee8f65a9f01a29d350173e8bd64c98
SHA512

a5797169b50255dd1e24756b9cb7b44f410f383ee86748a2216ddacf4bd7b99f10b318932b090ed0cd57e9f2fa15b5a0c191e88609412c90859c4788bc0be731
SSDEEP

3072:Hbj0xabjkvoV4W85koB9jI4S11VIa/9eOBDDEq47b7K6U8:P0xavkvoix5koBBI4gtDEvfK6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29
PID 2840 wrote to memory of 2216	2840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70c5716cec4941850e291dceb1d5216c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70c5716cec4941850e291dceb1d5216c.dll,#1
  2⤵
  PID:2216