70449df97a549531b91c10ae2c5e77569f9a98b4b08d02efa16ad5cc64def13a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:17

Target

09cc9baabb29723485105bf7378cef9f.dll
Size

56KB
MD5

09cc9baabb29723485105bf7378cef9f
SHA1

d151a22cc1bdf126dd0a4e16c7eb742081ffb764
SHA256

70449df97a549531b91c10ae2c5e77569f9a98b4b08d02efa16ad5cc64def13a
SHA512

8fe9e814589a79b8a580bbcc3539d398cdb83b84b889c339ac2141ccee673e6194665a05c0467f3fc4af2f6691c8f537b1bc29308e6a4f6148164e66d87c1634
SSDEEP

768:nalwIRqnmpjsmHHqlJfQwDvlwvA0ttaXIAov5DVyJBXoeZ09Xm8kCs/rEUbo7cqJ:8wIRqnmjsNCh+TEJ4XoeZ2cz/QNwAl4W

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28
PID 2224 wrote to memory of 2060	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09cc9baabb29723485105bf7378cef9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09cc9baabb29723485105bf7378cef9f.dll,#1
  2⤵
  PID:2060

memory/2060-0-0x0000000000200000-0x0000000000250000-memory.dmp

Filesize
320KB

Download