40e707976aef6ec05b50a76007e444b35b301adff4c210f3448c47a190a00b81

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 11:27

Target

6542310669b0546da41114925d9a534b.dll
Size

89KB
MD5

6542310669b0546da41114925d9a534b
SHA1

3b371997bef22253615165cf713477c356fe911b
SHA256

40e707976aef6ec05b50a76007e444b35b301adff4c210f3448c47a190a00b81
SHA512

c057658e3b1e11d84f955b773afe9321a53879316a49c9142f0d82f1ebf3b581f7a68c382a98e6021183665b41fc02c141e07d71abfdb795c64b64891d16d268
SSDEEP

1536:zMHSIHT9yM8vKOYj9XjYBjSso0innOW8eu3SP31pD1VSH9P:z1QT0hvKOiivoTO6pzSdP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28
PID 2420 wrote to memory of 3048	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6542310669b0546da41114925d9a534b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6542310669b0546da41114925d9a534b.dll,#1
  2⤵
  PID:3048