f99fb4f487c9e15ebdcb1a5c617edea164f17c8ec2182c30a8709ba80528969c

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:15

Target

0561fc6f14bf87812d19a72a74e15d06.dll
Size

16KB
MD5

0561fc6f14bf87812d19a72a74e15d06
SHA1

4bbd91f64f080d401a6f0a1d62404d29ec32a09b
SHA256

f99fb4f487c9e15ebdcb1a5c617edea164f17c8ec2182c30a8709ba80528969c
SHA512

795b282cbb2b03ffe64017b9860870de22c4562f4add2e0bba872331d3b2f1cbbcba77fe28428f343d45a94933a0f6e022b2cb3b4605f3495d1d475fc464c86e
SSDEEP

192:yqZ5k6hX7tdA2gpR1268iglgIsouurI5j9T2uoU8vNccbT5MIpH8GfiK4H:XZ5LrAfp3gigWIDuuUsFRMA8GSH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28
PID 2108 wrote to memory of 2868	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0561fc6f14bf87812d19a72a74e15d06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0561fc6f14bf87812d19a72a74e15d06.dll,#1
  2⤵
  PID:2868

memory/2868-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download