bd75d83392b8ad24ec75eda402b9dc1af56a56146ed96c540519218e835f5d0c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 14:28

Target

6fa8ff373e6e3348e249a4a391837a7b.dll
Size

23KB
MD5

6fa8ff373e6e3348e249a4a391837a7b
SHA1

fa7126aab20734c90b3af628a649963b098d5b2e
SHA256

bd75d83392b8ad24ec75eda402b9dc1af56a56146ed96c540519218e835f5d0c
SHA512

184b32f8514578177dc3b4e97d430c8e8f26e83cf8e9cba6b5d7ce89e1f42499c1d5abbe9e189c432d0440af15cf8f9614299059e4149669605d0802fd379d54
SSDEEP

384:o70CLOAmu4OZQf8+wQuipv7+3l2W4rTa5H/W+m5ZjOFxaVfRUjvpCMjQocnaP:BAHdQfKipDhW48HZSsaYhCyQocnm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17
PID 2912 wrote to memory of 2000	2912	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa8ff373e6e3348e249a4a391837a7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fa8ff373e6e3348e249a4a391837a7b.dll,#1
  2⤵
  PID:2000