256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 12:35

Target

256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2.dll
Size

208KB
MD5

a08d332b25bde5a088efbc4c1afa096d
SHA1

b1dbec2fd683acc9f906d61c1f728b439cae5a95
SHA256

256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2
SHA512

41c135cbfe861cbe4ec4b3f4e0cb657c98056497160dadffcaf5ec6cb74f594068024f9130b2382040061ee6b2ad99aa2326fad0eee2038f77aabaf922120978
SSDEEP

6144:9443XR4S38CnBeBxi66thkbAzLks1YarGR8ej4rC5Jj9:JM2MBIz+YLks1YarGR8PWj9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2664	2196	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\256eead542a5d5a1c8d73b5c9054363bcbeb7d04d3050146dbcfbbbef04ac1e2.dll,#1
2⤵
PID:2664