3fdcce3df429897ccca0676ec3a64129e78bf31c33558185262d0eb7a3ad0f7b

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:25

Target

06de4184d639090dd8fedbe30e8bb640.dll
Size

32KB
MD5

06de4184d639090dd8fedbe30e8bb640
SHA1

e579fcfb2bd987d29c0664b64023820443ae57af
SHA256

3fdcce3df429897ccca0676ec3a64129e78bf31c33558185262d0eb7a3ad0f7b
SHA512

ce50acf14a59763cf2f1520341114501dc2beba10d36716979b555b4ea50419cd68aa8619835475ad6222fbae2f60cf8f61330cb0d56e3dc7d5d128323e03e56
SSDEEP

384:Cvzj//RfqZ//4X7q2ilS+pe8Sz9lnBHvYfbeL00LpyiRO9PogQoWKGEygQiJuphA:k/AZS+VMzJAfglLpvE9qoW32JusJDNh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28
PID 1648 wrote to memory of 2156	1648	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06de4184d639090dd8fedbe30e8bb640.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06de4184d639090dd8fedbe30e8bb640.dll,#1
  2⤵
  PID:2156