ad7af8039d832bf7756a411280e511f9a5bf99a6a72588d85bde784fa2c96f03

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 04:29

Target

73bc292c05267e6cc0c33b653451d9b7.dll
Size

23KB
MD5

73bc292c05267e6cc0c33b653451d9b7
SHA1

11951543ca20cd94376f2eafd9c8a49adfe21eac
SHA256

ad7af8039d832bf7756a411280e511f9a5bf99a6a72588d85bde784fa2c96f03
SHA512

2a09d2170d65031ca64dff23f92c875aad32dff4bdb7014e15f15a211a23dbf25fdd6a089d636b8369005c77e22273bcaa5932daa2a8727b8c52571835a32a03
SSDEEP

384:V4kb8KsULpf6CQJ4tGjCehcB0CUG7mIQniCoHerzhNXqX2XfPl9pYUvWWnzcfTVP:GkgM6CQJ4tGNCmhF2q48gPK65LN7V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28
PID 1720 wrote to memory of 1752	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73bc292c05267e6cc0c33b653451d9b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73bc292c05267e6cc0c33b653451d9b7.dll,#1
  2⤵
  PID:1752

memory/1752-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1752-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1752-2-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download