5d4114410d4b7031b4e0e73356fcd714ae4f92d871178db7c6707250537719bb

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 01:47

Target

78f60820fe587dc081d1abeefaa6e46f.dll
Size

258KB
MD5

78f60820fe587dc081d1abeefaa6e46f
SHA1

40183ef83bff32e59377abc6a0ebde378c85b552
SHA256

5d4114410d4b7031b4e0e73356fcd714ae4f92d871178db7c6707250537719bb
SHA512

6961ab2ae1e95be5c7aca96f00122136a6e50b7bcd8dd2b164b897981b18d5c13ac3c4242e6a4bff14ce2193fbbf16107cfac719a864af27f66304fd1fc38834
SSDEEP

6144:c2XfwonKFcRlWSFkJIG9ZAdWE54Lg3BnTJh3X3vEF+:c2Xfw1WnWSUnAdUKBnTJh3XfE8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78f60820fe587dc081d1abeefaa6e46f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78f60820fe587dc081d1abeefaa6e46f.dll,#1
  2⤵
  PID:2372