ae3c145040737925c247c361d40f6b61edfdd7e601b450a59035963495db7bc5

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:31

Target

22ed00cd49f6643feb009fdd5a4f10f3.dll
Size

29KB
MD5

22ed00cd49f6643feb009fdd5a4f10f3
SHA1

9f9e1d8e08d26c2442c7309332dfc52a2742c122
SHA256

ae3c145040737925c247c361d40f6b61edfdd7e601b450a59035963495db7bc5
SHA512

00ce6797e1ac73ccd0f10e56e223a38b9d1c4e5b738c589cc32b56393b93de1ea6e581814dce96f11f4fb607fe278fa3d5a477f74475045477da2b9880fc3461
SSDEEP

384:WUnMA6iQCr+/I7KmicVzOKadirT5RJgg8HrqehZ57Gci/mO2utbh1iRw5Jp4nI7:NMTiLrX6cVOKauT5oPrtKmO29UJWc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28
PID 3060 wrote to memory of 2212	3060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22ed00cd49f6643feb009fdd5a4f10f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22ed00cd49f6643feb009fdd5a4f10f3.dll,#1
  2⤵
  PID:2212

memory/2212-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download