3e0b136c53232a3ab6523d2a1f9b99304fcadb5469fcdb846fd0ebfa48183b7e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 22:57

Target

54d00edf103c2f45137d453d60224b48.dll
Size

133KB
MD5

54d00edf103c2f45137d453d60224b48
SHA1

1c0e75967c6d7b733c0045b954d896fd157faa2d
SHA256

3e0b136c53232a3ab6523d2a1f9b99304fcadb5469fcdb846fd0ebfa48183b7e
SHA512

e41ee08be48a79e725b2d70cd7a52779e22b791af4f5badfcfe1a77f3b1ad528879845d5cad5db91b47488c7f198d2264c14228c8906504be97b0e7f7a2d3dcf
SSDEEP

1536:To2KIfBAqmmJtrBRgNY71Hc56eN+GwP5Oc1p8y0jZtEbmBwLkHSIiPErqdfuA5Vt:TEBNmbsC6XM1MxamFLnxDRGv8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28
PID 2104 wrote to memory of 1968	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54d00edf103c2f45137d453d60224b48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\54d00edf103c2f45137d453d60224b48.dll,#1
  2⤵
  PID:1968

memory/1968-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download