428df1bc948ae6b48543d2d7c42c4d8c3e65279dd6406d5fdb6aa05946c295e1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:29

Target

06f054f2cc466a88a0c7398dfc0c98fd.dll
Size

101KB
MD5

06f054f2cc466a88a0c7398dfc0c98fd
SHA1

88144ded7f57727fac3be99ca1884ef2077bcfcf
SHA256

428df1bc948ae6b48543d2d7c42c4d8c3e65279dd6406d5fdb6aa05946c295e1
SHA512

3df4919782659facf097de5c9351a6c94c18db8a6f80d220a1d910f740e89531b73b5525241e0b5491277c373ca075f32a23b1cd31e358ff5a312e45aea11c79
SSDEEP

3072:PJnYp+2EecbJ4IVk53rgQFYlOE3HAx1JfnNObMw8kyme3UirtQpilQi/zrJ/qTCu:CCecbOfifM6XO1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14
PID 2224 wrote to memory of 2060	2224	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06f054f2cc466a88a0c7398dfc0c98fd.dll,#1
1⤵
PID:2060

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06f054f2cc466a88a0c7398dfc0c98fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224