d990fdd189d779071207c8420def10ccada33a17aa0863020312adeb0ca05628

Analysis

max time kernel
118s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:52

Target

2c4c31fe92ed1c59fa5a4451de3cf221.dll
Size

359KB
MD5

2c4c31fe92ed1c59fa5a4451de3cf221
SHA1

e208cc6bc44be61c27dab8651ce3b4c47f145aa9
SHA256

d990fdd189d779071207c8420def10ccada33a17aa0863020312adeb0ca05628
SHA512

9fe1221ae24153b7093da8da9825054c6226a6e9db9e5740b4fac07e9850dbd74b48b7f530c2d2286e5307906cb3bcbbb0c857b62e2589818a193270e1119c51
SSDEEP

6144:UJwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyh:NkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17
PID 2664 wrote to memory of 2132	2664	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4c31fe92ed1c59fa5a4451de3cf221.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c4c31fe92ed1c59fa5a4451de3cf221.dll,#1
  2⤵
  PID:2132