b6e19d935305352319fd04df5a07b6435db5add16b57a05b30542adac748b771

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:25

Target

01a5fd2eed9da7919298afb3485b6057.dll
Size

292KB
MD5

01a5fd2eed9da7919298afb3485b6057
SHA1

6feb3a307574d679063d4e2d23e3affd4e59663d
SHA256

b6e19d935305352319fd04df5a07b6435db5add16b57a05b30542adac748b771
SHA512

62eaaeb0c3d0fac879f0664ed41d383c191e46e5bd4e07fc0ce371400de4080123706ca53797b2009aaf2f08adbe7b086ef04b052aa1df896fdaa39647ab011d
SSDEEP

6144:U7R6RaJfETkuMTEtqQBlI8qNKOppF2NgXsv13w+WW0XjCX0JoJWl4s:U7R64LCkQBl9qTFHstA+T0zCX0JoJ04s

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28
PID 2144 wrote to memory of 3020	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a5fd2eed9da7919298afb3485b6057.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01a5fd2eed9da7919298afb3485b6057.dll,#1
  2⤵
  PID:3020

memory/3020-0-0x0000000000200000-0x000000000024E000-memory.dmp

Filesize
312KB

Download
memory/3020-1-0x0000000000200000-0x000000000024E000-memory.dmp

Filesize
312KB

Download
memory/3020-2-0x0000000000200000-0x000000000024E000-memory.dmp

Filesize
312KB

Download
memory/3020-3-0x0000000000200000-0x000000000024E000-memory.dmp

Filesize
312KB

Download