140953f6297380d50669afef9f4945abae5b68fa8d982062ba465aa93ec24167

Analysis

max time kernel
122s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 23:01

Target

4224890b801d235c78303e8fd39263e1.dll
Size

526KB
MD5

4224890b801d235c78303e8fd39263e1
SHA1

6ea91d454b2b9cdc8fca175363e1dbe21ef30b08
SHA256

140953f6297380d50669afef9f4945abae5b68fa8d982062ba465aa93ec24167
SHA512

4e55ee05c0cd2fa933ad1b0d4d95fd65dabbbf0501def19b9c1ddb9d62d803365925569937e83af5c8cad6b071c66e1ca30bb6433fe4093fa4ad682489adda61
SSDEEP

12288:ZDFzQ3lu2BpLiPwlUfIKKuioD4LP22dwfEtaNBb:ZDFzQ3llsQUfIKKuZAP2ph

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29
PID 2316 wrote to memory of 2592	2316	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4224890b801d235c78303e8fd39263e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4224890b801d235c78303e8fd39263e1.dll,#1
  2⤵
  PID:2592