1d3de5c1d0678a4adb1f5be5fb8eb58d1d3c5d128959603b033b98019c61edef

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:35

Target

05c68ba3928537074e96a74add934dd7.dll
Size

26KB
MD5

05c68ba3928537074e96a74add934dd7
SHA1

0e011c9cd32ca2e6605466502a24b2c26d584d18
SHA256

1d3de5c1d0678a4adb1f5be5fb8eb58d1d3c5d128959603b033b98019c61edef
SHA512

e73ee9b6935c8b2fbc38b2599758794a9a4e2ccb775572153f4108727b351861abde39f6d64a80434bb2cde3089afe12d0931d2e6de4e8fe19226ac9ceca6395
SSDEEP

384:ilVEmJMkEjYh2sgOF8LllzMpCKxiD03aGT5DZ2FKLiqB+WD6WKrRN8NVwk4Nf:wVnukEXsRF8ZEiD03aurLj+WD6RRNw8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28
PID 1944 wrote to memory of 3064	1944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05c68ba3928537074e96a74add934dd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05c68ba3928537074e96a74add934dd7.dll,#1
  2⤵
  PID:3064