41e745815d4710d935c38ef1d0585ee6a922f31a6bfe1a673377060c4b79e788

Analysis

max time kernel
94s
max time network
39s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:58

Target

0dac08132d0abbfcb39b19ceae89e963.dll
Size

79KB
MD5

0dac08132d0abbfcb39b19ceae89e963
SHA1

ed656e96f864976d2ca54010cc4da29dde1db439
SHA256

41e745815d4710d935c38ef1d0585ee6a922f31a6bfe1a673377060c4b79e788
SHA512

df525d3ea2dfbd76838768d3e6b2c73fb130aa8c857d7936af54f7bb8fc24df024ecebfcac660fe46c55951d2b8cc6e6ce46315d9558fecb3e2b378495226ff2
SSDEEP

768:crMbDGUYXPd0KGa/L7lOy/5up+n8a4v6gTFO6CCF+yyq9QKeyf2KS9VwnKx:5KUaSaHQy4p+n8a2FkK+yhQGK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29
PID 2556 wrote to memory of 2984	2556	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dac08132d0abbfcb39b19ceae89e963.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dac08132d0abbfcb39b19ceae89e963.dll,#1
  2⤵
  PID:2984

memory/2984-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2984-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2984-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download