b7eb93a00889bfde1e6a98cf5bd63d9801fb6ea6a4a668964c712cc2448ea648

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 05:45

Target

768be54a4fc734e405c129df81cac9ff.dll
Size

37KB
MD5

768be54a4fc734e405c129df81cac9ff
SHA1

fb78277d4baaf9b0cada389a5ac47c6c271fa840
SHA256

b7eb93a00889bfde1e6a98cf5bd63d9801fb6ea6a4a668964c712cc2448ea648
SHA512

8978e36e997318cb696950a9e7e7615ba10ad9ac4aca6b3a33b40abba75601414c953216ed6838faaecaea7c9f7cd6b1d4d42058d54216e970e42cacee2f9a5b
SSDEEP

384:k63d3/QH4extHfzn6rb7VNVfY2Ar6KL3arbqH6sck/gGZJ4yI5z8gCM6s3AaIIHK:z3d/QHtNne/VjA2S3afpExPI5NdIwo5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\768be54a4fc734e405c129df81cac9ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\768be54a4fc734e405c129df81cac9ff.dll,#1
  2⤵
  PID:2328