c19a8a1295c41a8b40f03e2eed20d1431cc6d796ee6848c2ae3d3f7e3bed5de3

Analysis

max time kernel
240s
max time network
288s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:37

Target

0be1e32a79732a9fbe928973e08ab528.dll
Size

29KB
MD5

0be1e32a79732a9fbe928973e08ab528
SHA1

2198b711e6efd2837b0d7ccbee4754cbdb204f7c
SHA256

c19a8a1295c41a8b40f03e2eed20d1431cc6d796ee6848c2ae3d3f7e3bed5de3
SHA512

10c9cfbbf3ffb8973e916e0ec9b2d6063e54087d201b9a212f525a61005d2919d86a5ed8573d471b7dd3a1bbb8c5a28e6678f5f20c6a0e093b372e7f60e5a42c
SSDEEP

384:5yuzmk3ySFy81TvV5Olz9HkGlY8Mb1Lc+oYr40fV/nScF1L1zs1zb101n1dBAAzT:HM81TvV5EhkWYQSBfv3L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27
PID 2832 wrote to memory of 2588	2832	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be1e32a79732a9fbe928973e08ab528.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be1e32a79732a9fbe928973e08ab528.dll,#1
  2⤵
  PID:2588

memory/2588-0-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download
memory/2588-1-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download