2b1e8c69cba6382ac3f62dc217810640eaf414830dc30c1862321a0379f091f1

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:21

Target

06c6fa9558585147c13a580261fc9d18.dll
Size

33KB
MD5

06c6fa9558585147c13a580261fc9d18
SHA1

2181bb51dedc730da900318cbab45d37ff9be97d
SHA256

2b1e8c69cba6382ac3f62dc217810640eaf414830dc30c1862321a0379f091f1
SHA512

e88458dbd8f46e199e1f80e2443c8688f0134d28efdc0466b4de6a37d0831e4f59d7afd4bc9d79f91aa85c3c66867fc903d89af2d232cfda7798b5b2c5f8cafd
SSDEEP

384:CsfaKYmTz9Wmn+RDwVXtUAfTvxTP3oxX9BkLyi3BYoyxqFbHqT3CMgIwbKbu:JhNTzsm+SFTZUxtBkp3BYooIu0IdC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18
PID 3044 wrote to memory of 2912	3044	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c6fa9558585147c13a580261fc9d18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c6fa9558585147c13a580261fc9d18.dll,#1
  2⤵
  PID:2912