a54710850f64cab2e8bd345867cab812eac6b8f841c69c54ed52efbb2f3604d4

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:23

Target

15cf06782b4932429eaf0c4c34f2ae94.dll
Size

6KB
MD5

15cf06782b4932429eaf0c4c34f2ae94
SHA1

89ae50af2935cf3e4f002630dea85c7a56cc1183
SHA256

a54710850f64cab2e8bd345867cab812eac6b8f841c69c54ed52efbb2f3604d4
SHA512

73146cf2bfe221640a7986914d8a5722cee06abf8d061b5af40eabe65f29ace7dcae304dc153bb7631a46a77584cff1f365b57e42d775f7aab755f9cc7d1040a
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28
PID 2964 wrote to memory of 3032	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15cf06782b4932429eaf0c4c34f2ae94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15cf06782b4932429eaf0c4c34f2ae94.dll,#1
  2⤵
  PID:3032

memory/3032-0-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/3032-1-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/3032-2-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download