aadf3f56cab8af21abe9674f7a6a58ba0467b7e84f3aba727fd77b3d788aa375

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 17:34

Target

659ef93b8c4c13b754262de46d2b777f.dll
Size

96KB
MD5

659ef93b8c4c13b754262de46d2b777f
SHA1

523f7af7e0411538cdb5195201daadebe1539404
SHA256

aadf3f56cab8af21abe9674f7a6a58ba0467b7e84f3aba727fd77b3d788aa375
SHA512

1be628b1e5debd54ca7ca5336f68ae3bf35caf7a57d062b43d00341427d8e5bc1d5f316d569b635b72cf4d7d997afe8f5724aa7e8b140f028e0b06b95a697e22
SSDEEP

3072:BXYMZXV2jiv6FDVo8oyU8WFiIvmdxWWcRBbx2dOAf9ItiIRf:BXXXiBFDeJiQmd6Vx25ItdB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28
PID 2912 wrote to memory of 2460	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\659ef93b8c4c13b754262de46d2b777f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\659ef93b8c4c13b754262de46d2b777f.dll,#1
  2⤵
  PID:2460

memory/2460-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/2460-1-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download