215cf944bedde41cf0183d6a14b270b2b4b3fdd64e5095b51817f6ced55b72c1

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:17

Target

243ba3220eef13fdead67d28f6ab0d87.dll
Size

44KB
MD5

243ba3220eef13fdead67d28f6ab0d87
SHA1

8556de73e4c272d57415b314b999dc865a817ac3
SHA256

215cf944bedde41cf0183d6a14b270b2b4b3fdd64e5095b51817f6ced55b72c1
SHA512

0d87e7b1652b3d85fc6ed0ebfc0a458a0fd4efd302405b3811ff0b5beaae69d43326534de267d01ff85f70d13bf80cfef1fb9e54f50e878649b2a0ba58b78f38
SSDEEP

768:czGiun2P2rfBoa0VGJwK1ZNFhZPrCTLjgR0Rz2Ku0:czGBZuAJPZNFhZPM3gR0RCKu0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28
PID 2836 wrote to memory of 2716	2836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\243ba3220eef13fdead67d28f6ab0d87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\243ba3220eef13fdead67d28f6ab0d87.dll,#1
  2⤵
  PID:2716