a6132e8f9582201f3c65b1774409036e75d3f80932be8ea715eb1d54e12eb895

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 07:36

Target

5aa878fae133d8db6dbc16f4dc193081.dll
Size

140KB
MD5

5aa878fae133d8db6dbc16f4dc193081
SHA1

fa4c50efc1303e9572ea909f12e58b169aa81e8d
SHA256

a6132e8f9582201f3c65b1774409036e75d3f80932be8ea715eb1d54e12eb895
SHA512

9ebab3787ecefbb3dbb5ca3a25d14bb866084b542288f9a78f02c188299a919df75f9e0a638e5d4c2da5a30643a615c0106306a1410a382aac345bc37615a51d
SSDEEP

1536:kkCX3oqGlkl+TPDbJu+eozfm2D8QaXf0HvhiOgKtT6JGcA5xmVVuhVPUN3r:PulqbJu+eozmXQoKtOJGcwkVVGI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28
PID 2316 wrote to memory of 2324	2316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa878fae133d8db6dbc16f4dc193081.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5aa878fae133d8db6dbc16f4dc193081.dll,#1
  2⤵
  PID:2324

memory/2324-0-0x00000000001B0000-0x00000000001CB000-memory.dmp

Filesize
108KB

Download