aae68dce1231e97cbfd8a8fb0c71f0562cf6b29298a92739cf2069956cf123bc

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:45 UTC

Target

1c1bc0a70571e9a9a30eda524e69b19e.dll
Size

60KB
MD5

1c1bc0a70571e9a9a30eda524e69b19e
SHA1

b7e95a937765d58e5f318f79dd3b3a9e4ad2db48
SHA256

aae68dce1231e97cbfd8a8fb0c71f0562cf6b29298a92739cf2069956cf123bc
SHA512

901dda1c5d7d2da4bab5cd2365ac5d101b96145a134ed475e5774f2b48782cd4e284138dda15189aa55d6147747f055a5634de011a4e75194db0dac426af9002
SSDEEP

768:GbvLDaaMact8TeSFQbR9U3HsmbUasIZ367VATw5lMx4xSsHW80FiY0FBUDicY5sg:evySqGHs/kZvTKMn80Fi5RHxRhLaM5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28
PID 2176 wrote to memory of 2116	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c1bc0a70571e9a9a30eda524e69b19e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c1bc0a70571e9a9a30eda524e69b19e.dll,#1
  2⤵
  PID:2116

memory/2116-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download