a3924df964a4e90c60ab76c7627706dd4986c06c3c513b9dae66d2cb9dc80fe1

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 08:01

Target

lib/ExtendEdge.dll
Size

13KB
MD5

cb9472770470401df01b948054a8a17c
SHA1

d52913f655b0798649947296c144c2c3a97a56d7
SHA256

59b69b71a789bb38d89817ef235b1dfc67f546ffe87e0f732ae86f0538381953
SHA512

aae9c9a811ac04b5899103c0aaae1cab4e8dbde449341f329b1b72f82517ed9db2b38f16d4b536e1353898f531d787e9bb4d835964de4830a663114fda24f3a6
SSDEEP

192:lH9kibl5LYMm9OfPAjCkkb014FP3AzvlTAl8XiNtUR+PzRHtEiri5GAan:lH9kibldZm9OQerA14xQzvlcPtEMuGv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28
PID 2156 wrote to memory of 2460	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ExtendEdge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ExtendEdge.dll,#1
  2⤵
  PID:2460

memory/2460-2-0x0000000000100000-0x0000000000117000-memory.dmp

Filesize
92KB

Download
memory/2460-0-0x00000000006B0000-0x00000000006D4000-memory.dmp

Filesize
144KB

Download