475f9aeb0b02b2f276cdfff5f90d5fa012cf39c9199e87dc642b739bc58ecc48

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:28

Target

06ec0139ba74bbc1c0e5557533c5fe4c.dll
Size

14KB
MD5

06ec0139ba74bbc1c0e5557533c5fe4c
SHA1

01cceef177e6e7c6c63681a544b392adf7fca6d3
SHA256

475f9aeb0b02b2f276cdfff5f90d5fa012cf39c9199e87dc642b739bc58ecc48
SHA512

de4c26bea1c8d5d4ef71b94b072c4d1d075bffcb4097371bc3e546708adc22341385d3ceba9ce9c0e8220ecdbd88eb7b6ca2e2aa8507c98bd79b59981e65a775
SSDEEP

192:3fCEtTF8QMNP4Ds9m7YlhZcLsxSih9LfihsdPVa6+cQejm69NRdTNAmtVCpblxxK:3PtwADsLhZAsxSiX0sR1xZLbtVCR/+D

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18
PID 1360 wrote to memory of 2212	1360	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06ec0139ba74bbc1c0e5557533c5fe4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06ec0139ba74bbc1c0e5557533c5fe4c.dll,#1
  2⤵
  PID:2212

memory/2212-0-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download
memory/2212-1-0x0000000025000000-0x000000002501E000-memory.dmp

Filesize
120KB

Download