818df8f5543ccd521636ee10c3494d78dfcc00684ba1d8ccc1491b4cd0b35504

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 05:08

Target

5a5cd51506b581698e7ea43c5b400adc.dll
Size

171KB
MD5

5a5cd51506b581698e7ea43c5b400adc
SHA1

7fea8e59d81fcc1e1a048b7c1a00b0430cfc2ed7
SHA256

818df8f5543ccd521636ee10c3494d78dfcc00684ba1d8ccc1491b4cd0b35504
SHA512

fa9a9abc2150b8b3a727df041948c4ef13559e29ae55ee50a98edd9ae6180b8bcf08e851c0765d6b377e340672a67e22eaa9b17cafe8609b6e118bb57faa1a16
SSDEEP

3072:zxQ77wPVbRiY7fLRQE4aqV6aBNTeX5r7QCeUy0BNsk25mtLj4aM1Hw:Wab5f+V6ssr78A8k254A1Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16
PID 2968 wrote to memory of 2972	2968	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5cd51506b581698e7ea43c5b400adc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a5cd51506b581698e7ea43c5b400adc.dll,#1
  2⤵
  PID:2972

memory/2972-2-0x00000000003A0000-0x000000000042B000-memory.dmp

Filesize
556KB

Download
memory/2972-1-0x00000000003A0000-0x000000000042B000-memory.dmp

Filesize
556KB

Download
memory/2972-0-0x00000000003A0000-0x000000000042B000-memory.dmp

Filesize
556KB

Download