41c2018ce20b89450e721490ead156e4a434254930c046eb10a4bbc45e0bd752

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 19:24

Target

75507047e5a24edae825390a8b2f3135.dll
Size

64KB
MD5

75507047e5a24edae825390a8b2f3135
SHA1

4f8e089f84e765a942818b65afa6ec410621f8a4
SHA256

41c2018ce20b89450e721490ead156e4a434254930c046eb10a4bbc45e0bd752
SHA512

1e665c7f51c4309f96b756e51a5f2f9cbabf07a58da765d00cb2e3b3de41f53d2d919aaf815a5d831cc04e807e095fe1c9be0cf4f8773d3a925c1608b1034ec1
SSDEEP

1536:3pHgXUao7fZ/EyVJgaFVBydpTUpPjadBB:5AXUaq5EyzgarByjwpPjadB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28
PID 2964 wrote to memory of 1912	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75507047e5a24edae825390a8b2f3135.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75507047e5a24edae825390a8b2f3135.dll,#1
  2⤵
  PID:1912

memory/1912-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1912-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1912-2-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1912-3-0x0000000000110000-0x000000000011C000-memory.dmp

Filesize
48KB

Download
memory/1912-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download