8114ae7a0547da7b58adc3bd870b07cdd95646d4693c14984fffe1d1d8a9eabf

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 18:39

Target

7539b7c60f36f8827b19b2334ce26f3f.dll
Size

36KB
MD5

7539b7c60f36f8827b19b2334ce26f3f
SHA1

418b82cccc4ad6fdfdb293177ef058769be1be41
SHA256

8114ae7a0547da7b58adc3bd870b07cdd95646d4693c14984fffe1d1d8a9eabf
SHA512

0c0b8f8915678edc237c4f7970cb88c7a436c425b9354bded449dbd6ef11f713fd290f7efa77afebeebf39d92261e95d960e8fb6affdaa03671bd9bcc04f6800
SSDEEP

768:7862HBRoQO8sNMor19b9qAWQo31NwvfK4tErbT/j0/F:A908syO+Qo31Ng5tErj0/F

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28
PID 2896 wrote to memory of 2224	2896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7539b7c60f36f8827b19b2334ce26f3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7539b7c60f36f8827b19b2334ce26f3f.dll,#1
  2⤵
  PID:2224

memory/2224-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2224-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2224-2-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2224-3-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2224-4-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download