76d17d467d344b75b486a52ba1ecbaf316ffca52438c8a1b106e75c3f2ad2ad5

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 04:08

Target

5c1801a97e3c554428079654565c0f29.dll
Size

135KB
MD5

5c1801a97e3c554428079654565c0f29
SHA1

ea3895511d4fb0d57c4f69954c95962a3c9f138b
SHA256

76d17d467d344b75b486a52ba1ecbaf316ffca52438c8a1b106e75c3f2ad2ad5
SHA512

a02263595170150d8dbfe0097af370fe06166ac9a147a31eb923c9ec79223ecdd855a2a23fc89cf792875ca1e730405d7cceff454a5776dbe01228f6f5c169e4
SSDEEP

1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMlL:nu79WdaC2urufq33UeYuOS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28
PID 1708 wrote to memory of 2312	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1801a97e3c554428079654565c0f29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c1801a97e3c554428079654565c0f29.dll,#1
  2⤵
  PID:2312