1219511d179d1bb8c22f2a8c565d6262c5f588687f5d229d38dbc10d826e8bb9

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 13:28

Target

4b9058868a3d3952fdd68aadf497db63.dll
Size

19KB
MD5

4b9058868a3d3952fdd68aadf497db63
SHA1

d9660bbd613c089f52966e22dc8ba9f90dca6afb
SHA256

1219511d179d1bb8c22f2a8c565d6262c5f588687f5d229d38dbc10d826e8bb9
SHA512

608f93a350b4c75f0dee87de89527c42ae9b3e9a7a1feb805a53d31c1bc3e3fd586315c4474312aac962879b2c52c986f3fdfb80503600e8d70625e389159942
SSDEEP

384:iLgxD0rjlyUvdpoeOi5UF/f2I5XppxWHLofTkwoDlsm/v0m:fEzdpoji+F/RFnErofJqlsm1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16
PID 2888 wrote to memory of 2892	2888	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9058868a3d3952fdd68aadf497db63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9058868a3d3952fdd68aadf497db63.dll,#1
  2⤵
  PID:2892

memory/2892-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2892-4-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2892-3-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2892-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download