dd4b9e2e2e474b5c11a24d24e7cf796037f0b5674664c2b326deb93e200c4961

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 04:39

Target

5c2810cbe9ac29cfe9cd6779d866dc6d.dll
Size

228KB
MD5

5c2810cbe9ac29cfe9cd6779d866dc6d
SHA1

30f50690d966cdc9363ac8c9ac1dc321a96de5ae
SHA256

dd4b9e2e2e474b5c11a24d24e7cf796037f0b5674664c2b326deb93e200c4961
SHA512

d3cabcaea542ad6aa51cc1f7aa67641a23818f693707cd6da509b205cedfac8f8d0a0db1914b2392719b3fb3a96e7ce42aa2142a2c6a374ee179bb1aa529f6cf
SSDEEP

3072:eTuYjgRikkEvFg3fr+eEfftySI3AY1QayvwxjJBLiuw2do8LUTncp9lsZzikC/bO:eUviz6XtrOt5Jxfw2dHLUIpDCzi5ijSe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28
PID 2072 wrote to memory of 2168	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c2810cbe9ac29cfe9cd6779d866dc6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c2810cbe9ac29cfe9cd6779d866dc6d.dll,#1
  2⤵
  PID:2168

memory/2168-0-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download
memory/2168-1-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download