a79534282870e72ba451f32df3b332c24a5ef0266430ab1c8d6029cf766bc80e

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:07

Target

3932ee11add70dbfc8d457f1d3cde4e6.dll
Size

5KB
MD5

3932ee11add70dbfc8d457f1d3cde4e6
SHA1

9236cb98a7aad5e2b75276fbef389d0f245dcf45
SHA256

a79534282870e72ba451f32df3b332c24a5ef0266430ab1c8d6029cf766bc80e
SHA512

53d4468a866029c69971bd2a09c28e7dae186b778b3d7b9dcea0def9086e90ce06cfe56f243afb99fccacc8c74ab49a0fc05b73cae127cea1710cdde5e475afa
SSDEEP

96:TDtKeaZ44grGx+0ZskmL20R7d5JsaLsRk0BbW0qH5iFDHa1kgcwQwTK1:ntE8Os7xRXJsysR/EoxmkgUwu1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15
PID 3064 wrote to memory of 2132	3064	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3932ee11add70dbfc8d457f1d3cde4e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3932ee11add70dbfc8d457f1d3cde4e6.dll,#1
  2⤵
  PID:2132

memory/2132-0-0x0000000025000000-0x0000000025013000-memory.dmp

Filesize
76KB

Download