0d35f067f0a1e7d547980eb785e5c75bc572ace288a6206e28c54afcbd0a1661

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:09

Target

2ccec3e7b79925c313b19b8c6526481f.dll
Size

44KB
MD5

2ccec3e7b79925c313b19b8c6526481f
SHA1

0b1562fce02c9692998203810e97be1f14501258
SHA256

0d35f067f0a1e7d547980eb785e5c75bc572ace288a6206e28c54afcbd0a1661
SHA512

1cf91350d89d79315c4b0421a1f40c7612a46400cb7a72bc5b4d8568b9a98bf40c4fa20262f375e4a616cef966a25ade74df2dbd709133470e4a3bd3852899f0
SSDEEP

768:5X6xm1/ByEk7clJejVgKn6mCHGvFjLfOsIriSHrkuSrdvD3nbJLR9lLpy/2QJ3:5Kxm1ZyEk4loVjn6mCH8xrsZHrh6D3FQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ccec3e7b79925c313b19b8c6526481f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ccec3e7b79925c313b19b8c6526481f.dll,#1
  2⤵
  PID:2224

memory/2224-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2224-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2224-3-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2224-2-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download