1ff383cdee61b8c356f512adeafcc252b990fac8f8bc5e6b225254af58c77787

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:48

Target

128e294b9598f1aa2aad54dd9fd067f4.dll
Size

180KB
MD5

128e294b9598f1aa2aad54dd9fd067f4
SHA1

94dc62c68a9690a0ce2c31865776b601115f6cb3
SHA256

1ff383cdee61b8c356f512adeafcc252b990fac8f8bc5e6b225254af58c77787
SHA512

9da7432a34c09090d74c34c5a20d024f297821ff72c6f5769bce45d805a3d19aa7a73809bd5b6de50a958c426a34227f8bd1c24180c672f3f0f7c3a29cc3ea01
SSDEEP

3072:P6GxbzCz+j3UirC7ulYlv/cf6+2jUC1NMAmDRku1vYw:HbzCiLDrpYdcyXYDSu2w

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28
PID 2932 wrote to memory of 2996	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\128e294b9598f1aa2aad54dd9fd067f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\128e294b9598f1aa2aad54dd9fd067f4.dll,#1
  2⤵
  PID:2996