b42fc92540b8478dae6945e6ffeea7b414af5faf48849e5c01fc32b910e717bf

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 20:27

Target

b42fc92540b8478dae6945e6ffeea7b414af5faf48849e5c01fc32b910e717bf.dll
Size

1.2MB
MD5

bf01350ef879f2c1dd767c2c5f569a44
SHA1

12549181582e3ef471af5547f34a9382754ce870
SHA256

b42fc92540b8478dae6945e6ffeea7b414af5faf48849e5c01fc32b910e717bf
SHA512

235616e20ba5351ba444a53f41607ed25eacd777f983901dd526039d1b884b85eafa69c4b6f86f7622c35b73f6e6e6f6731806fde16cdb681ae553e3d31b8684
SSDEEP

24576:/0b4A3xZmdOdtlguWMrxk/BeiGJ4q/zmGf8jdmWsJhcL9+FEirEH7B:AsMrxk/B32mGfYcJQ9+FEf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 456	2548	rundll32.exe	28
PID 2548 wrote to memory of 456	2548	rundll32.exe	28
PID 2548 wrote to memory of 456	2548	rundll32.exe	28
PID 2548 wrote to memory of 456	2548	rundll32.exe	28
PID 2548 wrote to memory of 456	2548	rundll32.exe	28
PID 2548 wrote to memory of 456	2548	rundll32.exe	28
PID 2548 wrote to memory of 456	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b42fc92540b8478dae6945e6ffeea7b414af5faf48849e5c01fc32b910e717bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b42fc92540b8478dae6945e6ffeea7b414af5faf48849e5c01fc32b910e717bf.dll,#1
  2⤵
  PID:456