e6cdce912e989df7128145f7437565aa991db97e66def0c80fd46d053406db8b

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:42

Target

0ed6c0e76cf6231d868f1e0aa2bb0883.dll
Size

55KB
MD5

0ed6c0e76cf6231d868f1e0aa2bb0883
SHA1

42985a9b39d43a73377cbbf0724653ea873aa574
SHA256

e6cdce912e989df7128145f7437565aa991db97e66def0c80fd46d053406db8b
SHA512

840ba484b07e8854d1dc3125432e12ed645b2e5bbbf4bbb6d1ee935a1fe0c70ad466477c87a260c5468bcea4f6f0c49ce95094c9a8ceef0010a422533a5c1666
SSDEEP

768:3RoxJz+V43U32AX4v6IBgDaP7IKygyYxN6qwGm3LUNygbrjykMd7U5xXNUlAXu+o:Box1kb3/X4vNW+P/P8q49g/VYuXyXM6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28
PID 2172 wrote to memory of 3000	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed6c0e76cf6231d868f1e0aa2bb0883.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ed6c0e76cf6231d868f1e0aa2bb0883.dll,#1
  2⤵
  PID:3000

memory/3000-0-0x0000000000160000-0x00000000001B0000-memory.dmp

Filesize
320KB

Download