a778975e0e00a213f2e9b02c5def0181a9c488a522344f882051236f5b624c1e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 01:22

Target

78e8713121c41bd4b4912c849a518220.dll
Size

84KB
MD5

78e8713121c41bd4b4912c849a518220
SHA1

03cc8d092355a01c6b49007abcccf272c130346a
SHA256

a778975e0e00a213f2e9b02c5def0181a9c488a522344f882051236f5b624c1e
SHA512

46cb68c5d52ad958acb92f8d0a9a7233c3d3ace85f964a0fa006b9d170b3c5f528feea458be6ee50deb4040706299d23b1f8296c7ba3966851ff4c4fc7265350
SSDEEP

1536:j4VK7rRhY/6nIMT2YxCgtNUBYLscvkrOC5TNgfSzP+vtMJ7MDr:j4KW/6nZxJtNUBcvkrBSvty7Mf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28
PID 1888 wrote to memory of 2112	1888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78e8713121c41bd4b4912c849a518220.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78e8713121c41bd4b4912c849a518220.dll,#1
  2⤵
  PID:2112