aee38e7347ce838c23e72d291fe81a19cfe56089a44d1074451a8b435daebcf6

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:13

Target

0e11d9d4cd0b666ad63c38af5d1ea16b.dll
Size

758KB
MD5

0e11d9d4cd0b666ad63c38af5d1ea16b
SHA1

54d8ff1f5dcde9fc8de2758a2d9ec30e66132c61
SHA256

aee38e7347ce838c23e72d291fe81a19cfe56089a44d1074451a8b435daebcf6
SHA512

e833ec0ea1948b9872a19ef874323f47d2cfbdbd11af140ca62db2483741498c8bf50aa8bc800e4030186f990d053e6d9ff883caa17756f44d79f812a2105e9f
SSDEEP

192:u5g0xVlIKIS7uaWBniewhCg6XEu3MJ3bIzLAyD/ZHYPsz3RUw1JTax3O30pHxfdR:uzy1tglsGIz8ONr5T6xlJgBQ1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13
PID 2224 wrote to memory of 2060	2224	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e11d9d4cd0b666ad63c38af5d1ea16b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e11d9d4cd0b666ad63c38af5d1ea16b.dll,#1
  2⤵
  PID:2060

memory/2060-0-0x0000000020000000-0x000000002006C000-memory.dmp

Filesize
432KB

Download