58aac90a083dde368a24718fe48b0de5bdfb0fbdab89b28170e8fdc05942677e

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 16:24

Target

510c2936b2a1b353525b140bcdc76be7.dll
Size

159KB
MD5

510c2936b2a1b353525b140bcdc76be7
SHA1

5a701de74e420eb5bd783d75bfd64f72fa107e5d
SHA256

58aac90a083dde368a24718fe48b0de5bdfb0fbdab89b28170e8fdc05942677e
SHA512

625736f70175eb67f58cefc51e12841d865ea2aeb2e27ce5bb8247a724ea597c0c880bf4aa022d200ec195fd97bd57fcb2531ce96842554cd12f5eef39acd6a1
SSDEEP

3072:uT9bXDlnu5nz3ouOsTIrj6tWiF9B3tlyiGZOimHYyetMO3FLW07VIm1S:OhXB0NOU2jmTpy4ZIUkZM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28
PID 1672 wrote to memory of 3056	1672	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\510c2936b2a1b353525b140bcdc76be7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\510c2936b2a1b353525b140bcdc76be7.dll,#1
  2⤵
  PID:3056