5dfaa6c0fac088d8168cf51140a91a1b88b893b115956921e01111cae8d00712

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 23:44

Target

7b97e5544a4f9975fa57ed0c019dd551.dll
Size

572KB
MD5

7b97e5544a4f9975fa57ed0c019dd551
SHA1

82add1446d902ea48668f53b24235f50394ea62e
SHA256

5dfaa6c0fac088d8168cf51140a91a1b88b893b115956921e01111cae8d00712
SHA512

2db78b1ff0faf418da39aca8d0f1e5d6a5e4fd374f6f2bff360ac7c4d3cf439100aedacb35485017644ef2b03007c9995bb331872b6994525203bb02edecee11
SSDEEP

12288:sRyaW+38IHvF6Z6gH6AHAvZv9LAkkOfbQQEBqf5Pszwr9GBwST72RCzY:V7tuM3aAHC9LAkkOfeBqAwr9uL2RCM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28
PID 2216 wrote to memory of 1216	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b97e5544a4f9975fa57ed0c019dd551.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b97e5544a4f9975fa57ed0c019dd551.dll,#1
  2⤵
  PID:1216