242058e85d50155b5bf6bf46173ff62622ec55314c8bc7a8fdccef72a72ec958

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 09:12

Target

5adb653fe89ad93c53a751b65a80bb63.dll
Size

133KB
MD5

5adb653fe89ad93c53a751b65a80bb63
SHA1

51bc4ded8e392fe573f38082fe1711b46d541df7
SHA256

242058e85d50155b5bf6bf46173ff62622ec55314c8bc7a8fdccef72a72ec958
SHA512

a810c48dce699f47578042ed3aa8da8491f52fae265c75a5837450285a10454747b6c2b471eb2b8cdbace9d2e8cab8826d9d2ae5f2e076842ca7039cbeff2778
SSDEEP

1536:5mPgbL13FDuDfG2D8A+n3UirQY3BWXwHX9pRECj/r0Tezvd5y9/BIO/9uq02tuQq:mgbLZFg4QYRbpf0M5yr/9u1hQPS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5adb653fe89ad93c53a751b65a80bb63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5adb653fe89ad93c53a751b65a80bb63.dll,#1
  2⤵
  PID:2248

memory/2248-0-0x0000000000120000-0x0000000000146000-memory.dmp

Filesize
152KB

Download