0bcb31981e2f7fcc498a80b665948f77eb00d3046844d67af34e3970d47dd746

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:14

Target

fc109dad7efe49b51c5360b6bdfb46fc.dll
Size

32KB
MD5

fc109dad7efe49b51c5360b6bdfb46fc
SHA1

dc3e31f8484e5903e8efcf1cd82b947b34803958
SHA256

0bcb31981e2f7fcc498a80b665948f77eb00d3046844d67af34e3970d47dd746
SHA512

6ad8003059fba8cb5d1cff9a98bcbe5574f31a4e44fda6dbf11ae2ad8e73a16b8a0d8b95b409e02e4fae203782aba66744455ea9cb0a2a5a5f17ac3af4a937f1
SSDEEP

768:gzPG3w/lNz1iB42xQkua29TM8JfKQcQKMX916iMhFBjZNk:Ha0x/d2biEKMt16iMvVZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc109dad7efe49b51c5360b6bdfb46fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc109dad7efe49b51c5360b6bdfb46fc.dll,#1
  2⤵
  PID:3004