6b076b60bde9f79a9a0b85f6a33bd9c00cae7653f50bdb1d0fa4fc3109d29c17

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 04:55

Target

5a56c2ffcefdd012e0943615dfc394e0.dll
Size

90KB
MD5

5a56c2ffcefdd012e0943615dfc394e0
SHA1

67a58c612ca0cd2dd4976ed8016ac4469ac1bb86
SHA256

6b076b60bde9f79a9a0b85f6a33bd9c00cae7653f50bdb1d0fa4fc3109d29c17
SHA512

2c640017e996e6084858d302d706e8c8e4e347d86a836f9631f138902feab2289c4b1f259025ec9f8e3417d958b8435a40ce96f471245f35daabae734f3a7efc
SSDEEP

1536:55xZEjCRaYV4tL0d3rDSAaheL6amJlroZDBW5+y2TJzALGVhH:5WLYV4tk7RahZbvroq57OJ0iVd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28
PID 2380 wrote to memory of 3040	2380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a56c2ffcefdd012e0943615dfc394e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a56c2ffcefdd012e0943615dfc394e0.dll,#1
  2⤵
  PID:3040

memory/3040-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/3040-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/3040-2-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download