79197c88c08b57c90dd5bb5a144e404a186a57d5aaefb9bca4f6377641c698ff

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:36

Target

6636995c9ea682ae4807339f66ea7e03.dll
Size

102KB
MD5

6636995c9ea682ae4807339f66ea7e03
SHA1

a56dc31edc618f599bd87cdef4b461e4fd807dac
SHA256

79197c88c08b57c90dd5bb5a144e404a186a57d5aaefb9bca4f6377641c698ff
SHA512

b86dcd5631a3cee4491bdddd2568d3ecc594ddb11313fcd5221fa4f3436b743ee925b58111d84c7d6f944c2d558403fd08af4ff588377c5f4500ada4d6cfe02c
SSDEEP

1536:Vt7xDlf4W8ai2SN4EHgcIPk2uHpJiiCg8PfBpU21x4+BJaVXpl8T5jp4XEfQHG:1lf4xHgcNHqPZ4+BJaV5l8T5jucZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28
PID 2336 wrote to memory of 2304	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6636995c9ea682ae4807339f66ea7e03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6636995c9ea682ae4807339f66ea7e03.dll,#1
  2⤵
  PID:2304