6db61c3d292198e57cd7bf43826997ff4fb123988271699e901e33d9cb65787e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:37

Target

049a6877b95e556a3596527386583223.dll
Size

32KB
MD5

049a6877b95e556a3596527386583223
SHA1

227346160f400c24c43b47d2182e3fc91cf70405
SHA256

6db61c3d292198e57cd7bf43826997ff4fb123988271699e901e33d9cb65787e
SHA512

75730a6ba8e7b71ff6f560d74c9c62dcdf5adeab370ec120ce89684f73b8da60849593aac5b9ca24e64d1c8dd60d5a062d1ca025410997d9b6f16cf2e90679d1
SSDEEP

384:Z/Pu+Yh0/duWXwCXl+i/PQWa3Ox6q516DiuyC0DWp7YM6DwIWrGDH:Z9Y+/4WgAlbY3OxH51SiC4WpUMaWrgH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 1540	888	rundll32.exe	16
PID 888 wrote to memory of 1540	888	rundll32.exe	16
PID 888 wrote to memory of 1540	888	rundll32.exe	16
PID 888 wrote to memory of 1540	888	rundll32.exe	16
PID 888 wrote to memory of 1540	888	rundll32.exe	16
PID 888 wrote to memory of 1540	888	rundll32.exe	16
PID 888 wrote to memory of 1540	888	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049a6877b95e556a3596527386583223.dll,#1
1⤵
PID:1540

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049a6877b95e556a3596527386583223.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888

memory/1540-1-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download
memory/1540-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download