9aa078ca05990433cf6ce3d6ffd737b65f2594664470b7d29b5d3e2c2c26cfd0

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 06:10

Target

4017e8b8761e644217ca01996a000f75.dll
Size

92KB
MD5

4017e8b8761e644217ca01996a000f75
SHA1

d73eb539b3db5860dcf55ee93d578a5e6d6efdbf
SHA256

9aa078ca05990433cf6ce3d6ffd737b65f2594664470b7d29b5d3e2c2c26cfd0
SHA512

f207e375df3fc6ebaac99a8bc9659cef2a840de3cbba5dc2b899e140a4c3e8e60870e8195cbbe03c105c980581758fcc6cc2fe8727156651bf7d8848af38f421
SSDEEP

1536:TkBTwtqyd5xrXYbcGnPYGVdqw0eEl7bepBRi3WAycLLqLOnpoJp+yVUFAnJE:TrAYVOee8bGBoyuLqP0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28
PID 1972 wrote to memory of 2052	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4017e8b8761e644217ca01996a000f75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4017e8b8761e644217ca01996a000f75.dll,#1
  2⤵
  PID:2052

memory/2052-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2052-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2052-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download