8debab751c7db85f1c1546eaa703d03a7abb3cc8bf39ec0fb01d3a1efc5bdbb2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 12:52

Target

36cd9bd5331493f842baa5b9268e9a2e.dll
Size

81KB
MD5

36cd9bd5331493f842baa5b9268e9a2e
SHA1

7e85aa920dc34f2834b01e7588a5ef0b2c77820f
SHA256

8debab751c7db85f1c1546eaa703d03a7abb3cc8bf39ec0fb01d3a1efc5bdbb2
SHA512

470a848b3b51a5f5068003175819b637d0a990137886de1d8deb37ce873b4737a7bd414caecbb45203250b9a8f5e766aa967485fc60907edda550d4af0beef6a
SSDEEP

1536:kjRUeTd9UneIpc2CC5LaBvrSpIcEI4hl0fUnxlxOSU2177e2jy:kFVCLpGC5LNEIMl0fUxlnel

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14
PID 1740 wrote to memory of 2268	1740	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36cd9bd5331493f842baa5b9268e9a2e.dll,#1
1⤵
PID:2268

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36cd9bd5331493f842baa5b9268e9a2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

memory/2268-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download