fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 18:38

Target

fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f.dll
Size

1.9MB
MD5

04de8d92babf00aebea4b4e00efa1e2c
SHA1

173ed8d10491f255ab771f4cd79281c431f68bab
SHA256

fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f
SHA512

90a54fd2ae65a2906a1b4219fc26b588106fe813d9805398c1b0859e6d0545e5c72216f8c4106a1dee6524e118ba4b786a123a649fccf0dbc67ee098ef3bacf2
SSDEEP

49152:QOhuR//9nZ6sJm77KmgubMvX1HvN0BurwMUTdg1mAWjSsF:xc7nZ6sJm77Kmgu29GBurt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28
PID 3004 wrote to memory of 1824	3004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9ad660afde7215476dac4cabf65555eb9c0d4e104facf48bb327da7545827f.dll,#1
  2⤵
  PID:1824