e5ad7e956a34f88acab6e986a479fe3e9738725a1fc4df1cb6a934178a46513f

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 23:21

Target

4a0ab930900764473965d492b72dda72.dll
Size

216KB
MD5

4a0ab930900764473965d492b72dda72
SHA1

88348a61a0044141a1f3fc6e4723228872dd8b10
SHA256

e5ad7e956a34f88acab6e986a479fe3e9738725a1fc4df1cb6a934178a46513f
SHA512

77b244145406c62b37d722a12be1bbef35578a140f2b948454f1c81778003a1a6b6936e50e8d384991c696d50e1cd6c68ce84ab9aac04f9128638388ff7b1178
SSDEEP

3072:G5SZHI9O8JxvlkOgWKEH6WgSTmo271fIqsNAJFnyvOV:18O8blkOgWJtg6moYfmNAJRZV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28
PID 2392 wrote to memory of 2180	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0ab930900764473965d492b72dda72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a0ab930900764473965d492b72dda72.dll,#1
  2⤵
  PID:2180

memory/2180-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2180-1-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2180-2-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2180-3-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download