dc90c539641c839ef1c03c5b166ac03aa9f784376a702a7bae56721f3020f813

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:43

Target

79cb1ab2957cdf6686c88e00d40feb3a.dll
Size

136KB
MD5

79cb1ab2957cdf6686c88e00d40feb3a
SHA1

75647b3e43b0ebdf3bc1ad8bfdb77d453e737b6b
SHA256

dc90c539641c839ef1c03c5b166ac03aa9f784376a702a7bae56721f3020f813
SHA512

28158c5c62359df558de752a79e9d03aa33a2307dcd7386f463d0be5ce4140b45a67220717f06d2acc87281aa600a9d50fa554d33119498188de701f88596303
SSDEEP

3072:2/3xctjCJX4aRbWZIKjGOeoTX4RKMHiGkj2wdjMQ3:2/3QWCUSZ4FDKvGkjRQQ3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28
PID 2040 wrote to memory of 1920	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79cb1ab2957cdf6686c88e00d40feb3a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79cb1ab2957cdf6686c88e00d40feb3a.dll,#1
  2⤵
  PID:1920