9ac97cfef1b55f12887a95c5b5a680fa7dc40006582f3e4bd3260a966eec0de3

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:46

Target

0a8f8e538a2ac20322d293e9cb4e8c04.dll
Size

17KB
MD5

0a8f8e538a2ac20322d293e9cb4e8c04
SHA1

2ddf96e466a46400fad8700bc3597e92e0749fab
SHA256

9ac97cfef1b55f12887a95c5b5a680fa7dc40006582f3e4bd3260a966eec0de3
SHA512

c694b3437c65be0251d66e69c21e410427b52a2d5f42fa9c9cce5c7b84766b12dc26a6abc96393adaa33ce5b420cc49f64ae1d9ed61a2d02de47736cf0a585de
SSDEEP

384:6ehcM9RWJveQJEnJXF8xFJAg2gVQKOKHGcMgZM2Z:6ehcAIJv+XF8xFJARgGKlMgZZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28
PID 1352 wrote to memory of 2124	1352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8f8e538a2ac20322d293e9cb4e8c04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8f8e538a2ac20322d293e9cb4e8c04.dll,#1
  2⤵
  PID:2124