692d13fe426367a779ec85f85508c5c941cdd70566aade9ba5114df8b6efc269

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:15

Target

2152a4eb8e7c20d2621da699b0208eea.dll
Size

29KB
MD5

2152a4eb8e7c20d2621da699b0208eea
SHA1

93e08d95fb7eaba8c89194952418c7eb30f56ecb
SHA256

692d13fe426367a779ec85f85508c5c941cdd70566aade9ba5114df8b6efc269
SHA512

08ae2cb6dcb26bf911362abd0ba9ff2ea7a732438856f6f017b42af92f4e2638d984d0bd2e65d6ff9cedf1e4fb667ca0e0fa9d2d71603c7dc1e3f6b8d18f6f1e
SSDEEP

384:Eyuzmk3ySFy81TvV5Olz9HkGlY8MSnWYdJUQqMT30ioQ+VZ1W1R1Ofm1+1WIRpAJ:oM81TvV5EhkWYoWiJUQPX9Ow9LJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1944	848	rundll32.exe	28
PID 848 wrote to memory of 1944	848	rundll32.exe	28
PID 848 wrote to memory of 1944	848	rundll32.exe	28
PID 848 wrote to memory of 1944	848	rundll32.exe	28
PID 848 wrote to memory of 1944	848	rundll32.exe	28
PID 848 wrote to memory of 1944	848	rundll32.exe	28
PID 848 wrote to memory of 1944	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2152a4eb8e7c20d2621da699b0208eea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2152a4eb8e7c20d2621da699b0208eea.dll,#1
  2⤵
  PID:1944