2ade80fb962db0cc018d09d2719d60ff2bd96f0f0f01ad96917aaa8057ac4f19

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 13:40

Target

5b61f2269456c3690a1061daa810c5c3.dll
Size

17KB
MD5

5b61f2269456c3690a1061daa810c5c3
SHA1

c35900b59f8f58067102f03241eb2b2c69fb7c1b
SHA256

2ade80fb962db0cc018d09d2719d60ff2bd96f0f0f01ad96917aaa8057ac4f19
SHA512

33baf01023080684554aff148ad34b50559b78892c92cfdc95764c1e355ff8ec289d01841db7b12228ffc41862916917b281f85e810dccda52e0d6b6fcffaca6
SSDEEP

384:OHC5sxmXBd03E/jnspVMzuYV1mf7Mw39sa0b0U/vQOglx1TzOjb:Oi+x0dYErqVMzuwEMwNT20U/vgFC/

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11
PID 2420 wrote to memory of 2860	2420	rundll32.exe	11

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b61f2269456c3690a1061daa810c5c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b61f2269456c3690a1061daa810c5c3.dll,#1
  2⤵
  PID:2860

memory/2860-0-0x0000000025000000-0x0000000025027000-memory.dmp

Filesize
156KB

Download