52865a13478833260b109e81900bf60e8ff1439366d5c1d58c9a067578f0252a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:19

Target

0b705624fc7a40ff87fedc745ba564e4.dll
Size

291KB
MD5

0b705624fc7a40ff87fedc745ba564e4
SHA1

fcf4dd9a872ff3a3db5c676b4b08e281937cc3a5
SHA256

52865a13478833260b109e81900bf60e8ff1439366d5c1d58c9a067578f0252a
SHA512

1fcd0a8378cae8372af61386bf4eabd9d51e4e656865ea0c28846093fd1c6953dc072e1047d7e9c0b16b34b6c82e9b00801c279483dbe179aaa8f946b0b1908c
SSDEEP

6144:GGskUJ78Cwr9AjmwEF9yaF5urX6VEw1Cj8QRakIDsW6hB:GGF88pitEeG5YX6aXBRak0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14
PID 2104 wrote to memory of 1940	2104	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b705624fc7a40ff87fedc745ba564e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b705624fc7a40ff87fedc745ba564e4.dll,#1
  2⤵
  PID:1940

memory/1940-3-0x0000000013140000-0x0000000013247000-memory.dmp

Filesize
1.0MB

Download
memory/1940-2-0x0000000013140000-0x0000000013247000-memory.dmp

Filesize
1.0MB

Download
memory/1940-1-0x0000000013140000-0x0000000013247000-memory.dmp

Filesize
1.0MB

Download
memory/1940-0-0x0000000013140000-0x0000000013247000-memory.dmp

Filesize
1.0MB

Download