6dafa51fa2706627339790d2544af10a9b7d849e0aea568f001fff27565c1c89

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 04:01

Target

76544701f6d12383bfd89f52ac034580.dll
Size

150KB
MD5

76544701f6d12383bfd89f52ac034580
SHA1

affd047352eba39fe275f3ae3d5255ed97643ac1
SHA256

6dafa51fa2706627339790d2544af10a9b7d849e0aea568f001fff27565c1c89
SHA512

1e1f65bd27b96e2b066a33452096f8975d4d8c5ab34dc5da5d79dc9b7237713043ff73976858dd0a4876a2aa4075107863aa4116c6a22d5adc9a6f30a4e8fa0a
SSDEEP

1536:t8IcUIlIjkuvfZ/AuwqBQDaOHCg6naXe26RU52HVZVSPna:yOy8xvfGqibP6nVRb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28
PID 3048 wrote to memory of 3052	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76544701f6d12383bfd89f52ac034580.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76544701f6d12383bfd89f52ac034580.dll,#1
  2⤵
  PID:3052

memory/3052-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download