16b96e14b2d249d4b186cb50763cd54a4bf757e6ecd1e9a1965c3a740f5fd28c

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 19:28

Target

4c444d43e6894fca04c6e5aa92654210.dll
Size

70KB
MD5

4c444d43e6894fca04c6e5aa92654210
SHA1

e087bd50be6b3b15cf55b8259e3834c4941920be
SHA256

16b96e14b2d249d4b186cb50763cd54a4bf757e6ecd1e9a1965c3a740f5fd28c
SHA512

b74f0e0aab246727e0cd2608c9c3f730354f7b8860dc09a2b763cf08396138c83dc7365e2e2857686430c8261b8bbbb19ba0895a6fb34e5a672428cf9bc4b1ad
SSDEEP

1536:yUsNOgeGgqLdupHeP+dZCUlL+DmWQFKjA3FOSpGXP:yUsNOgeGg1+PwQKWQFKj1wGf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27
PID 2284 wrote to memory of 2668	2284	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c444d43e6894fca04c6e5aa92654210.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c444d43e6894fca04c6e5aa92654210.dll,#1
  2⤵
  PID:2668