bdd2ca6f5b6010cfcff6c5f5fcdc2132477b126bf0f90d020456871b424f543e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:37

Target

0356304c26683de2d8ea363fd6e0ad21.dll
Size

57KB
MD5

0356304c26683de2d8ea363fd6e0ad21
SHA1

d62f5045306e0437d57d81be4abcf2f889c1626e
SHA256

bdd2ca6f5b6010cfcff6c5f5fcdc2132477b126bf0f90d020456871b424f543e
SHA512

707db33b6adfee98d0e9dc5e58abe34871c14e8339fb422b86c5fb6ef32c701ad484500f2d68378b54bc10abc760a4013fb3a2e28d6f40f1491285400dd84a5e
SSDEEP

768:JGB6Dq6A7doms6X8N4R5+lxfuqpmzSslUrHIv4QyhnU/QdOL92ovAg+eyDkT:eWqp7q+X8qR5+lx5vr1TjdOxXyDS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16
PID 3004 wrote to memory of 1648	3004	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0356304c26683de2d8ea363fd6e0ad21.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0356304c26683de2d8ea363fd6e0ad21.dll,#1
  2⤵
  PID:1648