106171ba77bb1bbd0f4d3e52fec22430e6c1864a94c7ae80e5b0c6c590285b33

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:55

Target

2904d2af7581f1af6e4ba7a4e8522edf.dll
Size

25KB
MD5

2904d2af7581f1af6e4ba7a4e8522edf
SHA1

0f180073f8f9714773fe762f2d2cf3024139afbb
SHA256

106171ba77bb1bbd0f4d3e52fec22430e6c1864a94c7ae80e5b0c6c590285b33
SHA512

f49b5fcebe85b6fe4549816afe571dffd297ebfc7426c80d5d6ed62aaefd1528cf5e3fb8eecf0c259d3afef2fe377d98e25422be03af50f7fb0aab546bbeabc0
SSDEEP

384:mdZibPLqEH883VHVkTlHOl4/cHK3b4y9T00TTWSyA/YNDtrHEyy:mT8qgoSpHK560TTWSqNDtrq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16
PID 2468 wrote to memory of 2028	2468	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2904d2af7581f1af6e4ba7a4e8522edf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2904d2af7581f1af6e4ba7a4e8522edf.dll,#1
  2⤵
  PID:2028

memory/2028-1-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2028-3-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2028-2-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2028-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download