1407f5b2e85fc341a3a3675ae8e05bc4306b5c5694441e167864da94c42c9f3d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 13:59

Target

1acca196779bac09eb2e83df5d422a0c.dll
Size

240KB
MD5

1acca196779bac09eb2e83df5d422a0c
SHA1

2306ace78b9af601a15ffac313ced86263beed4e
SHA256

1407f5b2e85fc341a3a3675ae8e05bc4306b5c5694441e167864da94c42c9f3d
SHA512

30a180f0b36e23138792bf2861b891f64c61fb9f7da5961edebd33bef21eeb58e7506b2813b76ef7ffddbc6561f847050c327083af30bcf8bebe046ca11bb9bf
SSDEEP

6144:Jj2KWKwkAIvog5crU66ELp2pFarpii4akSRy9yF31I/3:52KJrAIvZaLpaQrpaCwyFc3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28
PID 1372 wrote to memory of 1604	1372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acca196779bac09eb2e83df5d422a0c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1acca196779bac09eb2e83df5d422a0c.dll,#1
  2⤵
  PID:1604

memory/1604-0-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/1604-1-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download
memory/1604-2-0x00000000001D0000-0x000000000020A000-memory.dmp

Filesize
232KB

Download