a36c7072fbbd275f3189791e892c02cd4374e5f2e03dc5a8d71d879825703d81

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 06:57

Target

74064afc15d700efbdff496169e27988.dll
Size

6KB
MD5

74064afc15d700efbdff496169e27988
SHA1

4a870d0307f5fa941889a8db37f58bd9cfca02a8
SHA256

a36c7072fbbd275f3189791e892c02cd4374e5f2e03dc5a8d71d879825703d81
SHA512

30d25894fca37315de36791cb643ad36a521ff46ec50d47fc2921fff7afbc4eb6cdd71236888d67118065425d5edb270e4520cdef951b6034885e5e1db263dd9
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbCD:xB4c4G6bn1k1sw0EW3enIWwGqb+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28
PID 1152 wrote to memory of 1984	1152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74064afc15d700efbdff496169e27988.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74064afc15d700efbdff496169e27988.dll,#1
  2⤵
  PID:1984

memory/1984-0-0x0000000000180000-0x0000000000186000-memory.dmp

Filesize
24KB

Download
memory/1984-1-0x0000000000180000-0x0000000000186000-memory.dmp

Filesize
24KB

Download