f004f135b88fe865a412687ce9d462d32828adc6a2092dffbe4a8fee59b7219a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 03:04

Target

4299a2b13cb244208d20cd00fb0c085e.dll
Size

151KB
MD5

4299a2b13cb244208d20cd00fb0c085e
SHA1

382d193df7cdbbac4d892b38904e86cfe5e5064b
SHA256

f004f135b88fe865a412687ce9d462d32828adc6a2092dffbe4a8fee59b7219a
SHA512

a672b931cffad020de40da6e4813027d703354566b2c396e495bc7a7a4a48b155b3426fa6b300bc991458551223a5d1e49c5679d38d2447d6ce9db54548ae984
SSDEEP

3072:y7R3stxOxwEAYXpuEWNhKum/GRJcKoam/jNKIkCv+3:y7R3sbOqEAYX8/hKu7RJA/jNKIBm3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4299a2b13cb244208d20cd00fb0c085e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4299a2b13cb244208d20cd00fb0c085e.dll,#1
  2⤵
  PID:1252