16e232493eacdb08996e3d4f40340bc069d1c03ff6fe4f185a9040585fe1f6f8

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:57

Target

119859ba470dd4f919a1bc917049b166.dll
Size

28KB
MD5

119859ba470dd4f919a1bc917049b166
SHA1

3639067a6d3d64c8b8cfabd1aaf8eab5d3a3635e
SHA256

16e232493eacdb08996e3d4f40340bc069d1c03ff6fe4f185a9040585fe1f6f8
SHA512

99348a0d5b0b29983676de48a08faced3e58b064959813f4c098bc7b46eba9f9b6112dc129efa2bb3a80c0a1ee16d8ee661bd0834367c65773bb2f47d36ad1c8
SSDEEP

384:61P0pOyXbe5prZ8LzRo1yXXYKUzuPbgMDCTDrPHtE6AU3Om2MTNZSwcQM/tU18:MPEC5prSvuYXXUuPbpDme7KZgQa4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\119859ba470dd4f919a1bc917049b166.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\119859ba470dd4f919a1bc917049b166.dll,#1
  2⤵
  PID:2504