db8e222318d3ed3e3852f5e43be581d404e268e76df5c69f4e87bd2022418fb7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 19:21

Target

754f01aa215dfa7f877177ad8a76ac7f.dll
Size

11KB
MD5

754f01aa215dfa7f877177ad8a76ac7f
SHA1

861a5aa09ed573fadb69531c0852f39659442213
SHA256

db8e222318d3ed3e3852f5e43be581d404e268e76df5c69f4e87bd2022418fb7
SHA512

6bfe2e7a1d0227141ad7334aa2707e99f2b95adb2bdd05b5fcd8a10e2edf8115d0d6740d68850225d33212e5ed6a5f53de8e661647d767ab688b3dd474db2581
SSDEEP

192:4gYoNSc57tNnE0eEdMKJCBHafMoAH8biCGDowHHPFBCiGhAzzN9qdHKK0:xYR67tN1mKJuAMoU8biCQopi6DdHs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754f01aa215dfa7f877177ad8a76ac7f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754f01aa215dfa7f877177ad8a76ac7f.dll,#1
  2⤵
  PID:2372