5087ae8a6ded84e3141ad0ed0710f74fe8a10ab3d2ed43d8eb3da50c6804143b

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 22:17

Target

72fd9865f523ba0ce6a0f2d956ca16d6.dll
Size

87KB
MD5

72fd9865f523ba0ce6a0f2d956ca16d6
SHA1

2756d7f1d88610137c6b5da5e9ee458976b8d6d9
SHA256

5087ae8a6ded84e3141ad0ed0710f74fe8a10ab3d2ed43d8eb3da50c6804143b
SHA512

c29b979e3bb7a3bfb18c448495ba658ee0e6dcecbfc8936635c417b5de454716af4ad335653a1441a21cf88f904e32862aab9968c0cbd4e4a5624b3ec1ff9e0e
SSDEEP

768:CnJici8RKQOC1mo3C9DBRuhjjkGDZJ9wnn8R3q4rNTfuwP2iACgR+1mVaFmnvaAi:6P0ZQ3xawGfOcnJFtukjz4BjucXrWe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28
PID 2144 wrote to memory of 2224	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72fd9865f523ba0ce6a0f2d956ca16d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72fd9865f523ba0ce6a0f2d956ca16d6.dll,#1
  2⤵
  PID:2224

memory/2224-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2224-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download