d426f89a621ea83110b13e5a4253fcd7330cf2a0e7ba10433f5a84b028c5c2dc

Analysis

max time kernel
143s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:18

Target

0b695d07546be0a0b09fe1e4b0b1309b.dll
Size

28KB
MD5

0b695d07546be0a0b09fe1e4b0b1309b
SHA1

f0e61e793ec1d1e46544f666a2819f9192b1d8c2
SHA256

d426f89a621ea83110b13e5a4253fcd7330cf2a0e7ba10433f5a84b028c5c2dc
SHA512

da74aa2e79ba72cfb398fdd3a8144fc0970dd7f005afa7aad4d929e7d7a011d76b47e18a926f1684d28f8e4d6459a432f862bd67d190a96b8bdaa630447257d7
SSDEEP

384:8tyuzCkzySFy8BTTVhOFf9nQWAOAYoEMOcbKwmIHLdcANQkHflaIm1Azlu8wl:MM8BTTVhgJQSoEtcLvNj4INlu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b695d07546be0a0b09fe1e4b0b1309b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b695d07546be0a0b09fe1e4b0b1309b.dll,#1
  2⤵
  PID:2360

memory/2360-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2360-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2360-12-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download