dc42fb58bb848ed7ae6629bc9ea091692242e98bee61e46d677cced48ebf2384

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 17:28

Target

6836e02bfe722bf89b7a16f208c427d4.dll
Size

194KB
MD5

6836e02bfe722bf89b7a16f208c427d4
SHA1

9b99fdbca8d5faefba0cff7e191a2fef5d324a75
SHA256

dc42fb58bb848ed7ae6629bc9ea091692242e98bee61e46d677cced48ebf2384
SHA512

0814615f269282828e5f4b04cb29df9532116103c398fc3a15bb2f9b67bf81e27e0f3018458ac56823a8f7fd62cbb7e521d6641a52557a5ab831bf69c269dd2f
SSDEEP

3072:BMphQJi7l6oPwdAR7wTzdRaH09jnWx4PYOaHl9nM7H0JTajR7:AhLlodqwTzd9jnWx4PYl9n4CYN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28
PID 2528 wrote to memory of 2860	2528	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6836e02bfe722bf89b7a16f208c427d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6836e02bfe722bf89b7a16f208c427d4.dll,#1
  2⤵
  PID:2860