5aee2b253609a63e03fe3c92c60402f306a3222ff2046bcef6998d2032d85891

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 16:04

Target

56e6403952449be661ec6022dd07ddcb.dll
Size

332KB
MD5

56e6403952449be661ec6022dd07ddcb
SHA1

de4ea2b47313b0adb318e94cd58071dbba5cb2cd
SHA256

5aee2b253609a63e03fe3c92c60402f306a3222ff2046bcef6998d2032d85891
SHA512

afe5dd4dfe3c2f6a8eee37b4e550e9eddcde34a5e6883ad7d781cd2d039499333f1db1834c6da69ae6a81c94d93e761f4adbf0d009a477916f4ed8fa9d15cfd6
SSDEEP

6144:Q1SKdnzDt8vVihY+jEEEwdRhQ3n3NtG6ocWqEyXqkq2Q4ur9nmxRI5i:ySkt8tUHEoC1aqK12Q4S9nFi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28
PID 2484 wrote to memory of 2164	2484	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56e6403952449be661ec6022dd07ddcb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56e6403952449be661ec6022dd07ddcb.dll,#1
  2⤵
  PID:2164