37cac7631f21aa78a72da3a4a8577b2e103fd02ddaf02f7731e35b383b66e0fc

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 17:17

Target

4173cf33be91ade641a07bec60147eec.dll
Size

52KB
MD5

4173cf33be91ade641a07bec60147eec
SHA1

168137d64a4d038abfcbcb9a717126fbd298605c
SHA256

37cac7631f21aa78a72da3a4a8577b2e103fd02ddaf02f7731e35b383b66e0fc
SHA512

40072072584e0b66a31a7e489620122453bb2162fbbf50f0b458ada308d17bce4fe6b090bf19a6df3bc0181c3b9f38e26fe56ca2c53cd100bcac2b08c7f3b922
SSDEEP

768:z3OHS8KOz/or/3ZfsCQU0iGMcLTEPn3ajMPeXuEyA1AUL49G7eCJu1f/k/hRAAL6:yHZmR6iGMQTEPzPyByajzoyPAYitR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14
PID 2288 wrote to memory of 2452	2288	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4173cf33be91ade641a07bec60147eec.dll,#1
1⤵
PID:2452

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4173cf33be91ade641a07bec60147eec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288