b59205a5cc5d2e5ebab1af319c6c2308ae4fe7c999c3140bbab8a2ac2b0daccc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 23:22

Target

476ec1e75c89e3948dcb001bae1027c5.dll
Size

23KB
MD5

476ec1e75c89e3948dcb001bae1027c5
SHA1

6f627e852e5c880c7cb926e2a938fe253b47201e
SHA256

b59205a5cc5d2e5ebab1af319c6c2308ae4fe7c999c3140bbab8a2ac2b0daccc
SHA512

508e52d0d406ce7cee7b8caf13a67170641217ecf12e8221e57aa307811b1052a61edd89c6d33d4b868bd9b0b82cd3b3eba5d1db23c8bbbc99357bc04b3866bc
SSDEEP

384:MRiSYMogs5lrxbsfGvDf0cwH58LCFuP2MVfzmbM+Agj9yYRWsO:M0AogG1xtDf0H58Ldzmw+AeyS7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\476ec1e75c89e3948dcb001bae1027c5.dll,#1
1⤵
PID:2992

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\476ec1e75c89e3948dcb001bae1027c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988