f28dd63eddcbd820da730ecbf347e510896a61083aca0e130125fd8f2bd4b84a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 16:16

Target

74f2caea84147cbc131eb3fa5fa2719c.dll
Size

23KB
MD5

74f2caea84147cbc131eb3fa5fa2719c
SHA1

eff81ce56ee2739e39b0dc980e9ec3e4a4d17cd0
SHA256

f28dd63eddcbd820da730ecbf347e510896a61083aca0e130125fd8f2bd4b84a
SHA512

b207f67ff1403070501c400f159d80ddd700a58799b7c0e86e20334c0a62fb325bbc81a01c7063e6a11ce9316c33a14c60974cc36707c6cbbf50a8585947c6b7
SSDEEP

384:MpKnogMkg01uHAHuuHHrLXGC5LT5MBXHIGf5iIv:MN5yqC5LT5mXHD5lv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28
PID 2748 wrote to memory of 3044	2748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f2caea84147cbc131eb3fa5fa2719c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74f2caea84147cbc131eb3fa5fa2719c.dll,#1
  2⤵
  PID:3044

memory/3044-0-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download
memory/3044-1-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download
memory/3044-2-0x0000000000130000-0x000000000013C000-memory.dmp

Filesize
48KB

Download
memory/3044-3-0x0000000000140000-0x000000000014C000-memory.dmp

Filesize
48KB

Download
memory/3044-4-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download