1bc6d6de146fffda6b4d849259f72b5066719f40193844347fc02d816c412126

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 15:54

Target

1bc6d6de146fffda6b4d849259f72b5066719f40193844347fc02d816c412126.dll
Size

1.5MB
MD5

fe944a0521fc10c2fedf0849d9a8597a
SHA1

6043aac585212d6956f1a89d5fb7f621cc3e5486
SHA256

1bc6d6de146fffda6b4d849259f72b5066719f40193844347fc02d816c412126
SHA512

fc42619a52132be4fbe05757edb804fee23b12f40f33530d0fb2d9413c2a95c511bbe1e81b26e2297e0eb74fc0041bdb2152c40378ab3e7a481bd770228132fb
SSDEEP

24576:0//AN3BJqIBOY6yWJoFjCyI9fBqyu+yI2QvcLmmFbzHZG5zbTuH:0XAN3BJqIBOY6yjFjIfBA+UQkrbjZhH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe
PID 2536 wrote to memory of 2800	2536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bc6d6de146fffda6b4d849259f72b5066719f40193844347fc02d816c412126.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bc6d6de146fffda6b4d849259f72b5066719f40193844347fc02d816c412126.dll,#1
2⤵
PID:2800