dd853e651f41df691ddff51d223fbf3acd6b032ed224100c974e06fb6dc1bc84

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:08

Target

22943c84943f32b967538e7c422c5134.dll
Size

207KB
MD5

22943c84943f32b967538e7c422c5134
SHA1

f6563b0c2220dfb2b6e6518132182030913089ec
SHA256

dd853e651f41df691ddff51d223fbf3acd6b032ed224100c974e06fb6dc1bc84
SHA512

96eff4177adf19b879c0eaf81e1940918dc83f1e1b2536a5e6e4c5fbeebf0ff8a36c7a20c0a5e8c2cc5516acfad970657bd48511ab75cfe07bc37915ab77df52
SSDEEP

3072:4ZO4Rd/yv8GoZegvVSbymnDSnyHOTgkTCxktFy7JHVtWZdncjlqDDHgXJYVb:F4r/iEIznun5gsdW7NVtWDcqkYVb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28
PID 2940 wrote to memory of 2936	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22943c84943f32b967538e7c422c5134.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22943c84943f32b967538e7c422c5134.dll,#1
  2⤵
  PID:2936