982be5e56dbd500dfb243fc9ca205be48bae1b492975b5bce2a96e09cd46d546

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:46

Target

17777257ed494cf0ea75b869a535c8f5.dll
Size

156KB
MD5

17777257ed494cf0ea75b869a535c8f5
SHA1

ad22bd07b4766ff67f05f01dd65c0d128a060781
SHA256

982be5e56dbd500dfb243fc9ca205be48bae1b492975b5bce2a96e09cd46d546
SHA512

7d7842030e05cff5d3810f8240b24b9a83a9a0aa7c8ccf30a3859c7171b418b43adfe1e542f444b6704122caad8fa8a860d575e20a47afc92bd3c1536ff13d96
SSDEEP

1536:vLMydMlWpt1Sd7iyt7QXLi7EN5Tv2fb87BK04wu5mk90wp48DinMrLQJ6AV0:vLMyW77iytsXLi76iNbZ1iMrLt7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28
PID 2212 wrote to memory of 1708	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17777257ed494cf0ea75b869a535c8f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17777257ed494cf0ea75b869a535c8f5.dll,#1
  2⤵
  PID:1708

memory/1708-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1708-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1708-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download