f6c28e7e9dc73f0f59db78875a65bc5fb621256ed9aeee398a82c52acbe12122

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:42

Target

1d5d1c3b00ca94d0a26a3e15d7f97eb5.dll
Size

14KB
MD5

1d5d1c3b00ca94d0a26a3e15d7f97eb5
SHA1

ff672f59881d82cf245f004e9d3a62c1cd27df0a
SHA256

f6c28e7e9dc73f0f59db78875a65bc5fb621256ed9aeee398a82c52acbe12122
SHA512

4b5b5be26195ae5411fb6f0d4de7c84ea1dbcf90c6643cc92b911717612804a190c74de2517b67155094ca57ceaa8d217e8fe14e54960855383bfb6c6ed7e81d
SSDEEP

192:9chmsojhLxh3L+BAiQJ15lByjgjUVkDwWnshznUbPyons2++qOy1:CmsojhLxh3L4Qz5XyEUO7eUDbHnqO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29
PID 2080 wrote to memory of 2668	2080	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d5d1c3b00ca94d0a26a3e15d7f97eb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d5d1c3b00ca94d0a26a3e15d7f97eb5.dll,#1
  2⤵
  PID:2668