6f49f878497552d4f0db7dce6279c809b886f53f9458f74efdb379a813544172

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:53

Target

19226e1e3d045fec70e07a230580cdf5.dll
Size

17KB
MD5

19226e1e3d045fec70e07a230580cdf5
SHA1

991efda79b1684900329cd3ab12037283d9b2356
SHA256

6f49f878497552d4f0db7dce6279c809b886f53f9458f74efdb379a813544172
SHA512

e6be254b4b4c9b43c5c4a3333cf494e1c520001e65baeb0e97f00dfaf331bf9035faec0424bb0d1dcfa37703040b69da8351cca8ae483f3b3f331277abfc32bb
SSDEEP

384:0fpZZE/zUAkyM1MpEYjiYqZtEXixOC0wiUWvEGmmEWAuePlrKWcH85H:0BeNfpEYxqPEXkWP4DuArbu85

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28
PID 3000 wrote to memory of 2376	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19226e1e3d045fec70e07a230580cdf5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19226e1e3d045fec70e07a230580cdf5.dll,#1
  2⤵
  PID:2376

memory/2376-0-0x0000000074880000-0x000000007488F000-memory.dmp

Filesize
60KB

Download
memory/2376-2-0x0000000074870000-0x000000007487F000-memory.dmp

Filesize
60KB

Download
memory/2376-4-0x0000000074870000-0x000000007487F000-memory.dmp

Filesize
60KB

Download
memory/2376-5-0x0000000074870000-0x000000007487F000-memory.dmp

Filesize
60KB

Download