6c667639fccc9d38880f404e083da944270247266b0da49c99a86dda01849eb9

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:12

Target

395a8d049132f9d3272b7ad7d921682e.dll
Size

31KB
MD5

395a8d049132f9d3272b7ad7d921682e
SHA1

a9a5d0ee3fab13df8e2d4ab62162faf93a1e7aec
SHA256

6c667639fccc9d38880f404e083da944270247266b0da49c99a86dda01849eb9
SHA512

6daad53ccc152656c1c9a4f2c3918a58794795b386c4e2ca240adc9e9c55ef57f81dc5ea1bfe8d4e5303618453bd365fb9b9e2ea9866c05f13b53dc9385cbc15
SSDEEP

384:blLU44nwgycRejM9kM/P3IdulSaxJYRQve59HC5npRJRfGe7uSUvqPvDaC:FU44nV5WK/vtise5YpxfN7LUvqjn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28
PID 2608 wrote to memory of 1752	2608	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\395a8d049132f9d3272b7ad7d921682e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\395a8d049132f9d3272b7ad7d921682e.dll,#1
  2⤵
  PID:1752

memory/1752-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1752-1-0x00000000000B0000-0x00000000000B5000-memory.dmp

Filesize
20KB

Download