b836332bf8d93e715ee50ad8498af1d5ef0e77e864d1378bf9dc4b2158cd7d25

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 17:41

Target

5429f165d5afe2b92862d1fd0e68e7b8.dll
Size

69KB
MD5

5429f165d5afe2b92862d1fd0e68e7b8
SHA1

320340ff095077a30f97e8029475a3bfc34dc5f8
SHA256

b836332bf8d93e715ee50ad8498af1d5ef0e77e864d1378bf9dc4b2158cd7d25
SHA512

09310e7361767d8108d8e3c34322a45312f9f323fe9b9aa798f0bab9d4ece7b33580a31d9c2f4091645e3c749f9b1386a05716a57ee4bc483d5444238983d42d
SSDEEP

1536:YFT2IyJsYzooktuQXPvhwD7YWo9zQ4dFOO3c/9ETw8qeyCk:YFvoktuQXPZ1L9BFO2c/9ETwCxk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14
PID 1652 wrote to memory of 3028	1652	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5429f165d5afe2b92862d1fd0e68e7b8.dll,#1
1⤵
PID:3028

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5429f165d5afe2b92862d1fd0e68e7b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652