c637dc4ac79f1853ba47c96bf67f10ade63fb878e341fed763f2ca99802a48bc

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:17

Target

37a48c47eec53391eebbdd0becd86686.dll
Size

44KB
MD5

37a48c47eec53391eebbdd0becd86686
SHA1

0165857a33fc89a4060e947d62be7c51da6f3267
SHA256

c637dc4ac79f1853ba47c96bf67f10ade63fb878e341fed763f2ca99802a48bc
SHA512

b3638a00231d06ac39d89a6f07e7e17f450611982f01c4969f0014491c761833af23979a1d0d1ce45163fe9a4469c25126a3ddb6a5560a48f071ba056ea8b595
SSDEEP

768:WTP4jfaHMDvvHDER80FY1LHhxGiKrtInDI0DyKMzE:zUMDHYR80FY1LBs/uU0mKMI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28
PID 2292 wrote to memory of 2380	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a48c47eec53391eebbdd0becd86686.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37a48c47eec53391eebbdd0becd86686.dll,#1
  2⤵
  PID:2380