ad4f7bd47531807346c5b65fcafeb5bf9079343e3f507b0084444fdb9ee6a623

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:57

Target

27297401f0f69aa664c1318ea0edae3d.dll
Size

47KB
MD5

27297401f0f69aa664c1318ea0edae3d
SHA1

cb604229d900706ebcd37a47e231e49dbae4be2b
SHA256

ad4f7bd47531807346c5b65fcafeb5bf9079343e3f507b0084444fdb9ee6a623
SHA512

a227c90d37a9621b53e02a930591facfd7e6ff516a6ce00a9f7d7985b62c1540910857c14c6fd06f76c14c5b34af1cd55b64d408dce5dbba37d32ecbaa13e994
SSDEEP

384:7nheRp/tLuI4IiZSQZxYYoYw6sjFYooBMpOiPtuPGB4mVBZ:7hSXLuIFipo/FurmJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27
PID 2536 wrote to memory of 2516	2536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27297401f0f69aa664c1318ea0edae3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27297401f0f69aa664c1318ea0edae3d.dll,#1
  2⤵
  PID:2516

memory/2516-0-0x0000000000110000-0x0000000000121000-memory.dmp

Filesize
68KB

Download
memory/2516-1-0x0000000000110000-0x0000000000121000-memory.dmp

Filesize
68KB

Download
memory/2516-2-0x0000000000170000-0x0000000000181000-memory.dmp

Filesize
68KB

Download
memory/2516-3-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download