691c5b255007d8c68a8249d0f0e25d7e893df2b4aba5bf3225e250e2c69f1c52

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:16

Target

4d90fa647fab55800455bb01475072a1.dll
Size

92KB
MD5

4d90fa647fab55800455bb01475072a1
SHA1

7483edb1783a611acf45acfbbd8a16eac79cd0e1
SHA256

691c5b255007d8c68a8249d0f0e25d7e893df2b4aba5bf3225e250e2c69f1c52
SHA512

5af4a0e3444e6d358b017a094d05aedb8464d832fa9d751decd900b8622fe6a9c6e4458ab649ac6ebe93ca280ace248ee1f0f2de5eed3b9d35f1dd411a491bc2
SSDEEP

1536:HDAdW68EdAs//iUbMevhq26cay8f6OOLI0xa/SNQoFR:HDAyEmSiUbZvhq26Bye6OOk0xa/SNQoL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28
PID 1740 wrote to memory of 2192	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d90fa647fab55800455bb01475072a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d90fa647fab55800455bb01475072a1.dll,#1
  2⤵
  PID:2192