4d7b9dfe31f04eeee117eabcae2490f9722bc64b88076a3b578f85f3bd4035bd

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:19

Target

06bb87ac54baa8014ed16aabedb0ca52.dll
Size

208KB
MD5

06bb87ac54baa8014ed16aabedb0ca52
SHA1

a5af9a087de9df971139c5ce09b83beb3c7163ac
SHA256

4d7b9dfe31f04eeee117eabcae2490f9722bc64b88076a3b578f85f3bd4035bd
SHA512

13bf97e8e3239cebddaae1b06284897dde8e8663135a333ef13d61f39b3ecb238276e3950010433af7899c9044f750b14d10cd5be0e3e090f2e261e2f9cc9ba2
SSDEEP

3072:lqko3uvXdbkI5O+FepzjoydiXo5uRGMucuLwpEMQLg9sHulUtJ:EkoaBkIvozjoydWR/VEg9sHr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29
PID 2228 wrote to memory of 2464	2228	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bb87ac54baa8014ed16aabedb0ca52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bb87ac54baa8014ed16aabedb0ca52.dll,#1
  2⤵
  PID:2464