752379e37418ffad81d39324250ec101065d7af39264ab0d9f5c8d514029c5d4

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 12:38

Target

36706e2e9195d1aed708012e91d16476.dll
Size

28KB
MD5

36706e2e9195d1aed708012e91d16476
SHA1

a96d4a8b4bbb5d6ddf68753fa7ecf7ff20aa5e79
SHA256

752379e37418ffad81d39324250ec101065d7af39264ab0d9f5c8d514029c5d4
SHA512

5d75e089e5c371cfca757663471fad0c3f3eace78a9f68833f6384bdafce4b6d366dd4a8b83b19d077b2ccffd0aae226fa11e4acdbf11801b55588b1197c04e6
SSDEEP

192:Gp7Y9ZpGMttv/FS1KdPl73fJPiY939T94toekDQKqNZgqrjQyKpct5Unswip+:Gp7mttnFpPBjNpskDM/oyKpct55r4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28
PID 2052 wrote to memory of 1992	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36706e2e9195d1aed708012e91d16476.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36706e2e9195d1aed708012e91d16476.dll,#1
  2⤵
  PID:1992