fb38f0e0f10b373a191cee3e0011a2a1a333a8296c82cdb62605f1792d0aad17

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 08:45

Target

40675ebab39431530e2559d476c18433.dll
Size

69KB
MD5

40675ebab39431530e2559d476c18433
SHA1

6b9b71b89ea5f0cf11d499a11b4346eb36620526
SHA256

fb38f0e0f10b373a191cee3e0011a2a1a333a8296c82cdb62605f1792d0aad17
SHA512

9f76303e7abf9d3c1be1391369da32d73fecacfa163f4189c058c06fcd7b973d80ebf18407143c22555e12651e900163531bdf4f10fcac6f317116a8d52dbe80
SSDEEP

1536:HJF4L9mV6pBYpyDI7uoGFmRbqAoyOgoBJw+QpWjyvPHaaF:HJWL9mVeYpyZoGFYuKOgKJw9/PHaU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28
PID 2128 wrote to memory of 2368	2128	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40675ebab39431530e2559d476c18433.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40675ebab39431530e2559d476c18433.dll,#1
  2⤵
  PID:2368