9a207f1d4d4e8efb45d9696cc8f9f014d10cf6d200acf2883462922c4af4332b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:01

Target

0afbaf3309461726c04ce9643c01f36e.dll
Size

518KB
MD5

0afbaf3309461726c04ce9643c01f36e
SHA1

63f7057a205b3970f8715cca07873b30783aa0b0
SHA256

9a207f1d4d4e8efb45d9696cc8f9f014d10cf6d200acf2883462922c4af4332b
SHA512

abf1990623452e315b22c4e37e4309bf940ad67c278d7a954d305759f72a388d201aca6eca1481474d56789ed73cbcfbb1660a5017549dcd813217a9b0d3ddf6
SSDEEP

12288:6ATdYOR+auARMlpwF1eBPP6BzYbXqSGFUV4ThZbmG68:6OVR+5lpwzIPPYYbXTaTHbB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14
PID 2140 wrote to memory of 2008	2140	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0afbaf3309461726c04ce9643c01f36e.dll,#1
1⤵
PID:2008

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0afbaf3309461726c04ce9643c01f36e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140