21684c81ed3ff9dae3df310eac57d86989b7f7b46c292bd4b35e3b3560520771

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 11:18

Target

16f76d45b50ca99db968ca121ad0a0eb.dll
Size

1.5MB
MD5

16f76d45b50ca99db968ca121ad0a0eb
SHA1

bfb6ff6702b1ff8671ffb96cfc9b1c69ed7b7fc4
SHA256

21684c81ed3ff9dae3df310eac57d86989b7f7b46c292bd4b35e3b3560520771
SHA512

2129b6dfd454e38f394bd86753121084422e9fa950d94342e26d91022c9a89aff27605bc489312aa807fb126ffdcb888bb78bafea08aa59f2f5d41d91da7cd50
SSDEEP

24576:QRYOQBLFIdu+pS0+M3tb0pvaep5ZxQt8llsQUfIKKuZAP2tgODjQMF5uuKY3m6:NLFSu/0J3tCieDL/sQxKbdFQMF5ucm6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16
PID 2784 wrote to memory of 2820	2784	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f76d45b50ca99db968ca121ad0a0eb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f76d45b50ca99db968ca121ad0a0eb.dll,#1
  2⤵
  PID:2820