5f64f90b82843b2e5e9a26121587c5a67c52bd206f918cea964686ae368aaaa6

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:25

Target

1e677c5edfd4d68d1c435f648688a454.dll
Size

16KB
MD5

1e677c5edfd4d68d1c435f648688a454
SHA1

0102e59f19873d1db949c4a18f1473eeb986f7df
SHA256

5f64f90b82843b2e5e9a26121587c5a67c52bd206f918cea964686ae368aaaa6
SHA512

a294a77fa551976510678437b559a208ae914e0af65151af429eb30bdaa9e16c80ab7add6e7743f833466d4071e9f45646ce6e532e08ec4f3978325a27b5b34d
SSDEEP

384:RvbGU4kzT2J7n/pT5l3b35ohvei/6+dQaIy0ao30wIX4:FbGU4kzi3P3mhvei/VdIy0DH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27
PID 1920 wrote to memory of 2940	1920	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e677c5edfd4d68d1c435f648688a454.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e677c5edfd4d68d1c435f648688a454.dll,#1
  2⤵
  PID:2940

memory/2940-0-0x0000000000190000-0x00000000001A3000-memory.dmp

Filesize
76KB

Download
memory/2940-1-0x0000000000190000-0x00000000001A3000-memory.dmp

Filesize
76KB

Download
memory/2940-2-0x0000000000190000-0x00000000001A3000-memory.dmp

Filesize
76KB

Download
memory/2940-3-0x0000000000190000-0x00000000001A3000-memory.dmp

Filesize
76KB

Download