170394d08a56349fc4c536702f8fab998f14bc2feeedf8d9c9f354201c18795f

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:38

Target

2a513ca8ed1c2744303fa256ec8e4870.dll
Size

17KB
MD5

2a513ca8ed1c2744303fa256ec8e4870
SHA1

55fa0a2ba51d1361db69b6cd1fc66fe2d8c2d05a
SHA256

170394d08a56349fc4c536702f8fab998f14bc2feeedf8d9c9f354201c18795f
SHA512

7967e4a61c6f451fd7b9d9c2492f11caf4f42ab8b6eee4dba6b62b033d884c8f1ab3b2c7e28fd7c687ce508d8407a58bad05b09a805806604de86f5d6234a7db
SSDEEP

384:FCdE/zUAkyM1MpEYjiYqZtEXixOC0qZFq3L5bv8qF+m5aWcH8Q:jNfpEYxqPEXklgv8qF+SLu8Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28
PID 2792 wrote to memory of 2404	2792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a513ca8ed1c2744303fa256ec8e4870.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a513ca8ed1c2744303fa256ec8e4870.dll,#1
  2⤵
  PID:2404

memory/2404-0-0x00000000750C0000-0x00000000750CF000-memory.dmp

Filesize
60KB

Download
memory/2404-2-0x00000000750A0000-0x00000000750AF000-memory.dmp

Filesize
60KB

Download
memory/2404-3-0x00000000750C0000-0x00000000750CF000-memory.dmp

Filesize
60KB

Download
memory/2404-1-0x00000000750C0000-0x00000000750CF000-memory.dmp

Filesize
60KB

Download