0229fca91b47f5a74265bd2fd058052a991da76cd70d920986726557e7cb760e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:07

Target

0c8003b16a022e1def50e2f10143c9b2.dll
Size

708KB
MD5

0c8003b16a022e1def50e2f10143c9b2
SHA1

c00ab49c8ee0614ff5e8e8e5d5e65ad50f418703
SHA256

0229fca91b47f5a74265bd2fd058052a991da76cd70d920986726557e7cb760e
SHA512

b89bfec242dade3d9cb6ff303edbdaae33106e39c8bde75b1426fc3a6f44d1a160d88e4389078c801b4d3b3dbc8d71435666281c980e6a3124cce31016581edb
SSDEEP

12288:L8D4rWWkA/0ZNDROaIzR3JG4rD+Mti9/nXMcqxkBlgCNHqU2LNUPFyYyz0hbBUHg:ADuS5ZNdOaMZnPE9PXMcmklgCmcFgibH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28
PID 2236 wrote to memory of 2136	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c8003b16a022e1def50e2f10143c9b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c8003b16a022e1def50e2f10143c9b2.dll,#1
  2⤵
  PID:2136

memory/2136-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download