20f240ab003e4b5b665c183858606c917bf0ca6b221b3791b4fa4f0a62c38ef3

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 16:07

Target

3e6bc2d6050c8b0cf8f761958df5cfa0.dll
Size

29KB
MD5

3e6bc2d6050c8b0cf8f761958df5cfa0
SHA1

726e88b0eb6008c7793240eb89de25801e5aa3db
SHA256

20f240ab003e4b5b665c183858606c917bf0ca6b221b3791b4fa4f0a62c38ef3
SHA512

ac80d2c5df42989212a87090df691028e19042c30a487514f75158821e46d1983809e9f634b2cc2d15df538d7880300c29c4dcc1743574e5dd6c89ce8e41eaa9
SSDEEP

384:JlDi2OfzWANHqvVvs33KaWBJvR0EBoKZgTEc9fUsE76bvCLNAW5cGa0LQtb9vez:rDi2OfzlwuKa8J50EBqs76GJAWA4cWz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28
PID 2288 wrote to memory of 1920	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e6bc2d6050c8b0cf8f761958df5cfa0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e6bc2d6050c8b0cf8f761958df5cfa0.dll,#1
  2⤵
  PID:1920