1e44344a2859aea00d7b4a1b95484e92973d3f4fca0a336ade6faba0991fac19

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:26

Target

29f4f5268d8fb3e0516a9b107bd1cee9.dll
Size

92KB
MD5

29f4f5268d8fb3e0516a9b107bd1cee9
SHA1

79483b71ef2c9b0598bac9483c3dacbb4fff6a07
SHA256

1e44344a2859aea00d7b4a1b95484e92973d3f4fca0a336ade6faba0991fac19
SHA512

54869cb9aee7cda59dc304779b999af396e6daf38aa57e6798dbbcd6d127cfd1e8f6f39f062df727a1937ed063ffe28bc9cc68985dd68389d45607fdedc8fd6d
SSDEEP

1536:RMtQwcyWOGVHlomOC/9TxmkAI7k4UH0RJIWn5ywe6yI5O2k1zng8AHi7zfCRhqDE:SyVHKmOClrJRieee55k1D9qMWhWp8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2184	836	rundll32.exe	16
PID 836 wrote to memory of 2184	836	rundll32.exe	16
PID 836 wrote to memory of 2184	836	rundll32.exe	16
PID 836 wrote to memory of 2184	836	rundll32.exe	16
PID 836 wrote to memory of 2184	836	rundll32.exe	16
PID 836 wrote to memory of 2184	836	rundll32.exe	16
PID 836 wrote to memory of 2184	836	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29f4f5268d8fb3e0516a9b107bd1cee9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29f4f5268d8fb3e0516a9b107bd1cee9.dll,#1
  2⤵
  PID:2184

memory/2184-1-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download
memory/2184-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download