3c5d9d554638e33ccbcbe9a6c0a517d4f1a0d69cebf885b36651060b15923d5f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:53

Target

38c60da098e409045ea43925193b644a.dll
Size

95KB
MD5

38c60da098e409045ea43925193b644a
SHA1

a39359288b60f5c92a9440780951cb043d3c36d5
SHA256

3c5d9d554638e33ccbcbe9a6c0a517d4f1a0d69cebf885b36651060b15923d5f
SHA512

67869abb55ea573641329e92cfc4e7f8f47f702436a7f4d389e069a9b7c9f58e89db958ca009fbfcb93602a5f642a78dc521a4bee8f98b38ed70e3b875c783e9
SSDEEP

1536:Of8fACeV3VcXwUDqi3iAJFodZ2JlHVOQdZOEtumZ5qt1dlNV9Ft1doK2Oc0d1JjS:5AC8VcXw6qiyiGdZUb/XOEt62Oc0d1/4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14
PID 2012 wrote to memory of 2120	2012	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c60da098e409045ea43925193b644a.dll,#1
1⤵
PID:2120

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c60da098e409045ea43925193b644a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012