09b108154cf1b32f00b0c66720b8fe7be6b041a9edbe12c03c6d1a3505e84ca6

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:51

Target

20aa426a93d53828bd1fa962120a0756.dll
Size

236KB
MD5

20aa426a93d53828bd1fa962120a0756
SHA1

d2c0ed44f81a2d2366c0b7c387344bb4664a9ca2
SHA256

09b108154cf1b32f00b0c66720b8fe7be6b041a9edbe12c03c6d1a3505e84ca6
SHA512

98888513e129fcf9f279680205ffc2ff1d981d20a9910e9b0ab5c82f6ac55ff8e2145745d2a3c7000b7351629b8576c0efc260df24ce690f305cb5ade3d4c4ed
SSDEEP

3072:hG+GfAt5bvgO8THIu7LU0P1UmaVHhXRuh8BZmBcbvcJMmcpLaSYEA:hG+GJ7L1aVHCyA+HzYEA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27
PID 2848 wrote to memory of 2832	2848	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20aa426a93d53828bd1fa962120a0756.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20aa426a93d53828bd1fa962120a0756.dll,#1
  2⤵
  PID:2832

memory/2832-0-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2832-1-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download