209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 23:55

Target

7ZipDLL.dll
Size

528KB
MD5

f6d23610080e21cbfaa000444fadc8a1
SHA1

48c034ddc65e5fe9869dd8ece3dc84ee5e3001f7
SHA256

d0122d8e4e64e34623fd8623209064ff2f82d13b5b37be0c05da9fc02023696f
SHA512

d47ac72b87e8e9dbb61658423b7d2855b5e8cf70aa5e813b66ab52b88ead0645e8f1f905369e8e6f307306a4c477e285f22c7d0a6a01745d78e3911daac364d8
SSDEEP

6144:HQvft+9m057+DFGPx0S51SIkSj1eIbpDzhGMvKUkqvJ7nK588wFONQfnoCl3atJg:HQvfUEsx0jYeIbLGbF758xOCfytxpG+Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1460	3008	rundll32.exe	88
PID 3008 wrote to memory of 1460	3008	rundll32.exe	88
PID 3008 wrote to memory of 1460	3008	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ZipDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ZipDLL.dll,#1
  2⤵
  PID:1460