6fa08106158d6b8bb510472427f8d0b039fcc731eaabdc07135ebb7b23aa81ec

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:20

Target

14586618fdfab3095a3787892cd5e9b6.dll
Size

24KB
MD5

14586618fdfab3095a3787892cd5e9b6
SHA1

ba98ef4ca7e071f52f3a24b06016adaeb94eb0b9
SHA256

6fa08106158d6b8bb510472427f8d0b039fcc731eaabdc07135ebb7b23aa81ec
SHA512

a9d6c64fe7cd2ef485161ac2ebe98c25668dfa6aa6296bc557dac35935bf2eb5a5420eb4459caafa9fb7f0af98a44262ea32cbf985d601937ee92d1866d9f0e3
SSDEEP

384:iTgxz0CTfIhqd+1PPQiXtP8yqLyxbV1P8FhFtg2tV/3UAzunAqT/m:GlCLwqdS3QYlwyxbV1UFhxpunT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28
PID 2548 wrote to memory of 1504	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14586618fdfab3095a3787892cd5e9b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14586618fdfab3095a3787892cd5e9b6.dll,#1
  2⤵
  PID:1504

memory/1504-0-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download