a3e1f5142c89c36e85acaa608acf3cb5159aa1a9b97ca11a00b5962e568fd2fd

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 02:06

Target

761a68228e8a16bc4273b61c293f280f.dll
Size

28KB
MD5

761a68228e8a16bc4273b61c293f280f
SHA1

878cb95c9e889c15878f93f80f0e963cc269c1fb
SHA256

a3e1f5142c89c36e85acaa608acf3cb5159aa1a9b97ca11a00b5962e568fd2fd
SHA512

3df403e2bf6c776270b395b80a37ea0848903eec7a51fddd5cda93aabe520e66129976b440ffe4bce78db3957e5b54d5b6690001174e94a8972784f5d156120a
SSDEEP

384:vSyKmxTKRiXob68bzLfo4Ze+hKgjxw9Jpct5J6fnKxU:vSyVy9GozLo4ZP3wTat5kfnKx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28
PID 1760 wrote to memory of 2168	1760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\761a68228e8a16bc4273b61c293f280f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\761a68228e8a16bc4273b61c293f280f.dll,#1
  2⤵
  PID:2168