f5780ceeefacc531c388edece2de094b7f2871c94e130db0d6374c600acbe616

Analysis

max time kernel
10s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 23:56

Target

665df86f76be03389c31fb687b2bd2a2.dll
Size

107KB
MD5

665df86f76be03389c31fb687b2bd2a2
SHA1

058f983100cac5d81420dfbe703821f3557a4162
SHA256

f5780ceeefacc531c388edece2de094b7f2871c94e130db0d6374c600acbe616
SHA512

0b0679d6e45640d40090e58d75a7a57821bb2d833adbf79d87c8ed212e2c95e91aabf67f645e8113348f8efedfadbd56438c11edf7879f057b0d39cdb60408dc
SSDEEP

1536:U3ZxMuvgf1dnbLd+bXSrkGPe1huQ2Hm4dx8EbnO53BgmQBB:U3TMTXMbXSrkGPNQ2Hm4dxjO5RgmQn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18
PID 1692 wrote to memory of 1536	1692	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\665df86f76be03389c31fb687b2bd2a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\665df86f76be03389c31fb687b2bd2a2.dll,#1
  2⤵
  PID:1536

memory/1536-0-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1536-1-0x0000000000120000-0x000000000012B000-memory.dmp

Filesize
44KB

Download
memory/1536-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download