acef7f0681bedb4a635e4d4d2e97b4030d27cf36be76a5c4eb1f3f400368c92a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 03:54

Target

47f5352276783b2277f44ee167921d2f.dll
Size

44KB
MD5

47f5352276783b2277f44ee167921d2f
SHA1

7daa65c22ca98c277843968d4845f256437dc8b2
SHA256

acef7f0681bedb4a635e4d4d2e97b4030d27cf36be76a5c4eb1f3f400368c92a
SHA512

ec780ca50bf78084de03828b99814b26a870861541794038975181c7b638b40f3f36ec7b0ebb1bb0a1980f935af3901bd37f9cbbf09847baeed25e1aa87b6cce
SSDEEP

768:W+2/zx9VtqkFK4esvXFHQ+W2Rq4mbzhITRFI3WtC1:WZzDquKtEwZ2Rq4mfhITRFIp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16
PID 2968 wrote to memory of 2984	2968	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47f5352276783b2277f44ee167921d2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47f5352276783b2277f44ee167921d2f.dll,#1
  2⤵
  PID:2984

memory/2984-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2984-3-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2984-2-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2984-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download