79e64abcbe565a2df463443817a9b20ea1114ca9412c6387cbed695aac905704

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:43

Target

1d63cfe43c9729bd9e4892b126b8fa28.dll
Size

48KB
MD5

1d63cfe43c9729bd9e4892b126b8fa28
SHA1

6d6b279cb2032e82bf6f1ac745e9967edf492cb8
SHA256

79e64abcbe565a2df463443817a9b20ea1114ca9412c6387cbed695aac905704
SHA512

544792787a7afada68a84ba9637610cf9501ba1e2b61ab0df6b40773bfdef3487161806fbbb88136735e05473e861ebb168a3dcd3540d24698ab7ed2e0360f1c
SSDEEP

384:/59W7E4IoBFwQSL0+gQzZV+GdAhEsvWZGm9qB2BfCmq+nxbhD1lGXa61s:R9W71tcQwE+V+GAhE8WZdlprqsRhzQaB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16
PID 2344 wrote to memory of 2052	2344	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d63cfe43c9729bd9e4892b126b8fa28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d63cfe43c9729bd9e4892b126b8fa28.dll,#1
  2⤵
  PID:2052