b44be8bdacae50bd182c306319b575de55e33d3b89bd986763f76af09bb1e19b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:58

Target

0c536d3e78c4530283333c3078602ccc.dll
Size

26KB
MD5

0c536d3e78c4530283333c3078602ccc
SHA1

d15c07143a3876c1ccb140ed12fbef3636528316
SHA256

b44be8bdacae50bd182c306319b575de55e33d3b89bd986763f76af09bb1e19b
SHA512

dd6107d113450fd9622a9693c005045808de99334cdeb4fdf13d54faa8f92a7cd3f173d7060786dfcee341cb099c5c54a9ea50c8ddc61b137990415c5afa6e6c
SSDEEP

384:hAHxUSoqujqPKnGQuvKzsbRtko13RjOvl2nATpYU/BM2KFIAzAZOp:qKSoqueP0GQZzottpOvw6nZeFtAZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28
PID 2992 wrote to memory of 3012	2992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c536d3e78c4530283333c3078602ccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c536d3e78c4530283333c3078602ccc.dll,#1
  2⤵
  PID:3012

memory/3012-0-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download