7be47870030872b1ca25e376a512b94dfa4a7e8e4572b7c6ce01efa0f7245999

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:53

Target

12afb898bf770f92602dd3afe8f75309.dll
Size

512KB
MD5

12afb898bf770f92602dd3afe8f75309
SHA1

3ad84367bbab522a09082360b2974803c10611da
SHA256

7be47870030872b1ca25e376a512b94dfa4a7e8e4572b7c6ce01efa0f7245999
SHA512

ab89c9a13f474560f18bbc65dd19f46f62917269407ff0b3c066ca659d5985bef653c7a6367002b1492a64658bc6a8eafb1f7fd1ff8a1ffaf1514a008f356bba
SSDEEP

12288:bE0dszx+rMG5ACFfp5wBOcXSJHAa3/UqdIEqL9H:re9+YG5ACFR5wBOcCHcq3kH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12afb898bf770f92602dd3afe8f75309.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12afb898bf770f92602dd3afe8f75309.dll,#1
  2⤵
  PID:2256

memory/2256-0-0x0000000060040000-0x00000000600C1000-memory.dmp

Filesize
516KB

Download
memory/2256-1-0x0000000060040000-0x00000000600C1000-memory.dmp

Filesize
516KB

Download