d61bd3378baf0d3ad310d6aac861baec3c1cde59d15dd5174e46d451abbfa18a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:30

Target

2bc17a158cfc9bf7ab71517818f73dea.dll
Size

126KB
MD5

2bc17a158cfc9bf7ab71517818f73dea
SHA1

a85f4b9ba7493c75db4e6617d25a44fa9d9086b7
SHA256

d61bd3378baf0d3ad310d6aac861baec3c1cde59d15dd5174e46d451abbfa18a
SHA512

ce5321dfe1c62c0f5fad74cef2df26291621f3cc97fe5e538d9b2877318ac99e31bfacb6968bf94343f1296f324437226dabd186429a038ebcf63ddb5a5ccf9d
SSDEEP

1536:50dGw8Zc9MP6+fKd09jtLGb+kHqs7ouggNkTQiNUHT7Bf:50dGN6+fKd0h5Gb2iou7NkUKcBf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28
PID 1684 wrote to memory of 2040	1684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc17a158cfc9bf7ab71517818f73dea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc17a158cfc9bf7ab71517818f73dea.dll,#1
  2⤵
  PID:2040

memory/2040-0-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/2040-1-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download