12ee0abaff4148c34f1127cf6885dd6f2ba78c2d99915edd1a7e6793de5b4d94

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:48

Target

13b500fa529c13724375f12860881588.dll
Size

11KB
MD5

13b500fa529c13724375f12860881588
SHA1

4bfc87457fc5a7206aa925f560a41f8ece764035
SHA256

12ee0abaff4148c34f1127cf6885dd6f2ba78c2d99915edd1a7e6793de5b4d94
SHA512

ca4061af1c1a6a6e31825ae7c3ea19b3fd6257b58451f0b07ba866b760c293b14338e6825cd754f87c5f2cff9464081b102c1c0fa8207925bd117ed7159fce49
SSDEEP

192:mPoW/WyrTX4EGOue2EG1HixdmFvBDvdyexDwxWZmEc:mPoW/WoT7GOue2EkCxdmFvXbyxWVc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13b500fa529c13724375f12860881588.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13b500fa529c13724375f12860881588.dll,#1
  2⤵
  PID:2276

memory/2276-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2276-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download