526160a5e4d3b4fa9a174d1912e9f5028cf4bad710215cea2a498bb8fbe9300a

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 00:42

Target

57888d9d068c8f63dd1dff1bbc548ddf.dll
Size

68KB
MD5

57888d9d068c8f63dd1dff1bbc548ddf
SHA1

00912c175dc53ae12a0813f2c0af487c53abdb23
SHA256

526160a5e4d3b4fa9a174d1912e9f5028cf4bad710215cea2a498bb8fbe9300a
SHA512

c3279de1a001ae2df499179e528944e3d335b79b84ad5b8c7d943a81169f0a7ec7fb77b203a4164d90044729058acf7d6a904ca6b82a5b8eb7cc0e9b18235358
SSDEEP

1536:iFzN559FOq3lXg/g9WCH2vjkU4KgFxKW5ZTL//NKPX2:gzPLXdZQkqQxKW5ZTL/lKPG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28
PID 2444 wrote to memory of 1820	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57888d9d068c8f63dd1dff1bbc548ddf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57888d9d068c8f63dd1dff1bbc548ddf.dll,#1
  2⤵
  PID:1820

memory/1820-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1820-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download