15cabb862494607a49329cf484a15e55746c2493b036afd3f254d7909e15416e

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 02:33

Target

553f3b65a0f761eddc8a47385f955a0a.dll
Size

208KB
MD5

553f3b65a0f761eddc8a47385f955a0a
SHA1

b341744471c7a6b4af669e7ed2ddf79095819c48
SHA256

15cabb862494607a49329cf484a15e55746c2493b036afd3f254d7909e15416e
SHA512

f7568584cccb0530004c8878df8589b0a40b412da8941fe983298526f2b278cb1fad5b32933b62709ccbc05222f46923056c93dd78a16f828c78eac7365c1fe5
SSDEEP

3072:4+Nhi1VrktOyDAC6mBuaj8pA4yab+ww+D9cma63UVtV2bNcI:snAO0rjxaCrhma6aGNr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28
PID 2472 wrote to memory of 1036	2472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\553f3b65a0f761eddc8a47385f955a0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\553f3b65a0f761eddc8a47385f955a0a.dll,#1
  2⤵
  PID:1036