4db26bf2cdcdce6e0d8a69ad76149c76fcf15e9796cebfe2074711e254e35c51

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 16:45

Target

59376106f9ac9c6d5f349b27f6ca29cf.dll
Size

42KB
MD5

59376106f9ac9c6d5f349b27f6ca29cf
SHA1

b945e2f4ad1f49131bd53953220e92cccb564539
SHA256

4db26bf2cdcdce6e0d8a69ad76149c76fcf15e9796cebfe2074711e254e35c51
SHA512

e9240edb1d87f0042fac09d152ea2b863aaa08c5534e9cfb3957d0afaf91c3d5c41991856f7cf7eb3055a8370cf5fd556eae1638a858feff876bbeb08633c6ba
SSDEEP

768:2lAqQidiEgzdbkpjhWToENNqDKt76mr7TKttBro7PpPJdTWBnRECriM:SA/6bgzB0FENNqCFr7TKJroBLanREC/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28
PID 3016 wrote to memory of 2668	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59376106f9ac9c6d5f349b27f6ca29cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59376106f9ac9c6d5f349b27f6ca29cf.dll,#1
  2⤵
  PID:2668