5341b3921b75549adbe59365517c30bd045e63162728d9ba48f79832fea1bea0

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 17:21

Target

DriverLib.dll
Size

22KB
MD5

ca6b745157ad28955f5a988a10cd93f5
SHA1

289d0afd961d4c579cf85aeb20961531adb31d0d
SHA256

a81ea08c9952d61be170f19eb7922887ec1ec798cd43b95f4e7b5e8cdcdeaea8
SHA512

e8aedfacf304c459a43367d706cfcfc6a740c933ce4ba4fb01cb84f125826eb7ecac093d2d99622fab410fd12e387be6293230f5c03087624e83f7fb857d83a8
SSDEEP

384:SHRajxnG7aKcPhQhXfFvxQCqsLbhrBzDQVK9zyqnV3fYJLea8oNE54XdUb+j:SHRajxnNKcP67hVT9zyqV3uLCij

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2972	1156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverLib.dll,#1
2⤵
PID:2972