9f8a5891d5efcbacfb89d892037be98871084da12726e65b62a4c63501898a48

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 20:15

Target

5461c702606411f61421d0a09ffe237b.dll
Size

101KB
MD5

5461c702606411f61421d0a09ffe237b
SHA1

16d5b934366f2fbbfd50799aa001a10f04f65685
SHA256

9f8a5891d5efcbacfb89d892037be98871084da12726e65b62a4c63501898a48
SHA512

4103d212cb8b7ce827c86358f5090f25a80abf0449b7d31f7eb26462a0bfced5b74489db63d8a845b442ff3ef20ab796a86b4c897c51ecf49836fa681ed437d2
SSDEEP

1536:FpsHkdQcOiG9wHwEBMqDRcYgQf9+8tW/aetizvpCKGueV:/sEROiG9xxqDR/gq9+8sSetOvpCLueV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5
PID 1716 wrote to memory of 2516	1716	rundll32.exe	5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5461c702606411f61421d0a09ffe237b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5461c702606411f61421d0a09ffe237b.dll,#1
  2⤵
  PID:2516