cb661ec0d25c3456054f41af732e48440ac0c173f0e8e5bbc27000d90fd5af61

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:43

Target

1a64a76a900932027263afffc1f96748.dll
Size

90KB
MD5

1a64a76a900932027263afffc1f96748
SHA1

79655073a28756fd3796a5e901cb536a17cc7d91
SHA256

cb661ec0d25c3456054f41af732e48440ac0c173f0e8e5bbc27000d90fd5af61
SHA512

31f9655279aa4f594b7101792a818e60e638748bb82d216bd6fb42d009e58b57729b0ed7c04b23b96b4cbaeb811112160f957755e7aa77332dcfd58a17019753
SSDEEP

768:1Xf/yDxA8rQprMkyXvmRHHXaAc/rjcQK/P7jtmGxWKQffPPQ5TSbe5b:tAA802ktRHHXaAmHc//PtWLaTS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28
PID 2088 wrote to memory of 2860	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a64a76a900932027263afffc1f96748.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a64a76a900932027263afffc1f96748.dll,#1
  2⤵
  PID:2860

memory/2860-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download