12edaa3f4c250b065cbed0b0ca86fafe0b365aa4f955fb7b2e87cb05bb46e67a

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 09:16

Target

4deddc7ffb3f9d44c4648ac6928db8d0.dll
Size

216KB
MD5

4deddc7ffb3f9d44c4648ac6928db8d0
SHA1

6e432625a10f0a2ee3c90a2e7fe03ecbb169c904
SHA256

12edaa3f4c250b065cbed0b0ca86fafe0b365aa4f955fb7b2e87cb05bb46e67a
SHA512

e5e2b99ef954017bad85780ca16b67649110ff8fc7dd1da6a22f08881daefe12c24e60c33eddc41bb2c13e7b9e9a8f7616dbefa00b92c9d11a3a8dce848e51a3
SSDEEP

3072:TgCMryQJ4ZRx1e63C6YIkIWX8wesWXX03QwtWkjVipMF8+DbnSvsSR3ZuGc:TgLNJ4PWswCPkow8m2sSZZG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28
PID 1244 wrote to memory of 2848	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4deddc7ffb3f9d44c4648ac6928db8d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4deddc7ffb3f9d44c4648ac6928db8d0.dll,#1
  2⤵
  PID:2848