b416baac9ce0887c7c61fe2be5a0d8a4ae101b47c90d321e0fba2908ce373422

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 11:11

Target

50670c080f15770065b4430a4169fa65.dll
Size

46KB
MD5

50670c080f15770065b4430a4169fa65
SHA1

03c8048e2637e5e16b03904b4ee290156c4884fd
SHA256

b416baac9ce0887c7c61fe2be5a0d8a4ae101b47c90d321e0fba2908ce373422
SHA512

c5538b89438aaae2ffe1d210ec9d5638daecca3c11b6d5646bffeb9625154aebb993deb20aba737300e596929f0072addf385838b193d466e1a1e3002aab7c9a
SSDEEP

768:fmpM8peLohboGvEHATCjMAWGz3O+cGoCFA2EA+JStHr7AkCMql:faHoHuCj/WKouAxarFil

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28
PID 2356 wrote to memory of 2288	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50670c080f15770065b4430a4169fa65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50670c080f15770065b4430a4169fa65.dll,#1
  2⤵
  PID:2288

memory/2288-0-0x00000000000B0000-0x00000000000C0000-memory.dmp

Filesize
64KB

Download