3cd0aec175db0fb0ab46fe7eca3749c3b82caa478d988dc8fd50b5b37a1fec42

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:38

Target

fd50df1d245855d805e281e54db14a0b.dll
Size

97KB
MD5

fd50df1d245855d805e281e54db14a0b
SHA1

f4d5d24e7a0ed715a1475a2227030abb78317c26
SHA256

3cd0aec175db0fb0ab46fe7eca3749c3b82caa478d988dc8fd50b5b37a1fec42
SHA512

46b07b1f21589f66653865717d61447b48d4ef93c30a1244bc068eb6b686c4a6c53e90ec2bd871b23b22e0c2f6023f2117fa2a366431d0c55bd752e2cd4d2f83
SSDEEP

1536:eIb/I0ICkuvfZ/AuwKd6kaTEWFSPtcAJn91fpj/D7+C+Y/105b:eMzhxvfGK1wSPtNn1pj/DiCh10

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28
PID 2252 wrote to memory of 2508	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd50df1d245855d805e281e54db14a0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd50df1d245855d805e281e54db14a0b.dll,#1
  2⤵
  PID:2508

memory/2508-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2508-1-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2508-2-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download