8b1695a7e99b1f0af184faaf3c9cca2356aa17d4067b3883a1aba7397c8baac3

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 07:46

Target

4ad9c97eb0eb1f6be6c5523c5a0304a3.dll
Size

88KB
MD5

4ad9c97eb0eb1f6be6c5523c5a0304a3
SHA1

7a944006e6159d67355cb3f7084f158ffc4548a3
SHA256

8b1695a7e99b1f0af184faaf3c9cca2356aa17d4067b3883a1aba7397c8baac3
SHA512

8793ac2713ded4c76049bd41f88c7a808a12ae504acb30887acbdf6787f6f7e3cf0429ed2c8ee594026db2b293abc3bee557ef79b432b02834d197cc4bedbba8
SSDEEP

1536:wiIdbaULgKSbEF8S2a44ecOBfKiKitAzzHC/c:wiIduULfSY+S2a4zc4fKiKiCzbC/c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19
PID 2944 wrote to memory of 2516	2944	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9c97eb0eb1f6be6c5523c5a0304a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ad9c97eb0eb1f6be6c5523c5a0304a3.dll,#1
  2⤵
  PID:2516

memory/2516-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2516-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2516-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2516-0-0x0000000000120000-0x000000000012D000-memory.dmp

Filesize
52KB

Download
memory/2516-7-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download