77a1d6f668683e3e1f132f6e44cf0cfe9afd4c78d1c43d59e3c7e5213e6e83ec

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 07:35

Target

3c4376d5899eff01d314d05900bef000.dll
Size

45KB
MD5

3c4376d5899eff01d314d05900bef000
SHA1

0467e3c5cfcd33ae529ed837b5aba8ce38a0133f
SHA256

77a1d6f668683e3e1f132f6e44cf0cfe9afd4c78d1c43d59e3c7e5213e6e83ec
SHA512

dcb48bda7dba559ce6f5df93690baac3f9f496f4ccd5ab7e5d7e09ba21da04517d26fb7aef6c353b13824b926ee0eb1572e509d21feb93ab4292751f35fdd187
SSDEEP

768:xS/MqQ9/NQYggZ7Fz7AKbr1lduZIfspdGqX42DvkplJPmZ+:I/MqK/NQ7kgir1fMqlUZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28
PID 2976 wrote to memory of 2856	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4376d5899eff01d314d05900bef000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4376d5899eff01d314d05900bef000.dll,#1
  2⤵
  PID:2856