59535e54ec41f343f586709a7f19e92bae3ea0f1e3a91b5aae1f2571395bf8c9

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 19:07

Target

70543867d650e8073a85a6e8a7a98951.dll
Size

36KB
MD5

70543867d650e8073a85a6e8a7a98951
SHA1

32849156deb4d04f9e7c81e6a9b54ca0e1d6b03d
SHA256

59535e54ec41f343f586709a7f19e92bae3ea0f1e3a91b5aae1f2571395bf8c9
SHA512

f134c75897414c0e08b8d874a65436d645a3e9a09e07772911ad68413b8f8d6fa0b524936920e699f73368711ccb0dadefdefafcb7f9badf7fcf4deaf92c518a
SSDEEP

768:QWLnUr7ihkMWTzj/5BzUmj+moDBBQARQkTFwf/o:XLUrwkD/j/5BzUcl4BBQARw/o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70543867d650e8073a85a6e8a7a98951.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70543867d650e8073a85a6e8a7a98951.dll,#1
  2⤵
  PID:2376