1563c3a4436a1c19708bdba1d961c3eb8da182f82b23129cfb13ee6a25558d56

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:08

Target

014288ed928c69c229bae97bbcd976aa.dll
Size

276KB
MD5

014288ed928c69c229bae97bbcd976aa
SHA1

4bddc1861052738988c6970ae1bb571abc8ebd90
SHA256

1563c3a4436a1c19708bdba1d961c3eb8da182f82b23129cfb13ee6a25558d56
SHA512

b52296db2ab784a9cd35691ae99e1e3e284fa5b6f1938d0dcdb43214f66f10d441801369651faa2db2317e0473061b4f0000fc16f5a0aea0045399217f7f980e
SSDEEP

6144:dOSjIXo9jPDv5eisvDs8W7s9ZuJrUO//oOqzTzlUK/zNFe5kQn:k549zDUis7s8W7GYAOqWAMiQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28
PID 2288 wrote to memory of 2368	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\014288ed928c69c229bae97bbcd976aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\014288ed928c69c229bae97bbcd976aa.dll,#1
  2⤵
  PID:2368

memory/2368-0-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download