4f6460e424bcafc97cca3603ef507dac1dba6c5692f23e727145f8afb0cd4990

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:19

Target

02de6af0bf85bbb7c09e94c04ade8914.dll
Size

50KB
MD5

02de6af0bf85bbb7c09e94c04ade8914
SHA1

352a3c48dc59de8cde82b5dbfafa1b05c19961f0
SHA256

4f6460e424bcafc97cca3603ef507dac1dba6c5692f23e727145f8afb0cd4990
SHA512

4d50c5a81b4b6f25a0590dad68a911b51f3f461abd97b27d43f765213a0d51c5ba55de8656b57a29c7ab720d51cd87b79327109ba80b73355b73263fbd2e41e9
SSDEEP

768:pF5n3rImuDz6/WNZMh4RVUdj3PLle9UCvK1u6rkR7rH1db:pLnJuDz6/WzMqDUdHle9ZS4dR7b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28
PID 2032 wrote to memory of 2000	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02de6af0bf85bbb7c09e94c04ade8914.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02de6af0bf85bbb7c09e94c04ade8914.dll,#1
  2⤵
  PID:2000

memory/2000-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2000-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2000-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2000-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2000-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2000-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download