4621c6b608248df6c2c29c754924074bd159b49937855387959c8cc5e1eac6e9

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:21

Target

1e4f935d06a5b288a716bf5f8a8b4da7.dll
Size

40KB
MD5

1e4f935d06a5b288a716bf5f8a8b4da7
SHA1

edb75e0236bbf0b7f30c92ebee905f4b27bddff6
SHA256

4621c6b608248df6c2c29c754924074bd159b49937855387959c8cc5e1eac6e9
SHA512

ee793cafb35f0ac61dcef90294b5b9c4116bc2b3fc95c3c35153413ea860a40fa5c800956992d35d88d5bfd610d6866ae6ce5f9b9d1797e28d37e14c4bba4978
SSDEEP

768:UKtDKhZtv3gq4Bbe0fuc/KRMuGHTlo04zTxRrQeSTfkQTTDA9b:jtDITAbeKC6uGxoLbSTfkQTTD2b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15
PID 2668 wrote to memory of 1296	2668	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e4f935d06a5b288a716bf5f8a8b4da7.dll,#1
1⤵
PID:1296

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e4f935d06a5b288a716bf5f8a8b4da7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668

memory/1296-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1296-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1296-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download