5afd341f1594abdc63f196c2e41f0a12d141c15fd548b78f4ed693e8deb58455

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:47

Target

0a958183edf6aec54cbdbd1799898403.dll
Size

128KB
MD5

0a958183edf6aec54cbdbd1799898403
SHA1

8001267e4ab7d71fcd6d8fe478236fed95631f77
SHA256

5afd341f1594abdc63f196c2e41f0a12d141c15fd548b78f4ed693e8deb58455
SHA512

82692e0a885ac09ecca86f641de52de8ba1ff9acb04decc2f7fc57af17256a771bc8e303577bf1db7bcc3244fee932910952b85f3090fdb4a167747ef95df069
SSDEEP

3072:L7IoN0jHoecsYaFREidoCoz/775LxM8NUSyk3sBSvcY5P:fIoN0jHyFafEieCoDVitBSkY5P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28
PID 2868 wrote to memory of 2320	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a958183edf6aec54cbdbd1799898403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a958183edf6aec54cbdbd1799898403.dll,#1
  2⤵
  PID:2320

memory/2320-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/2320-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2320-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2320-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download