75e31e56d5735f7d52a7ec6f34f0415bc2778d638381981f7121581ba41b8cb3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 12:46

Target

7a4af142f5d13358c6f13f74aa6a5e58.dll
Size

652KB
MD5

7a4af142f5d13358c6f13f74aa6a5e58
SHA1

40581db03dedfb8f3e00768c1f5228950c2e26d7
SHA256

75e31e56d5735f7d52a7ec6f34f0415bc2778d638381981f7121581ba41b8cb3
SHA512

f6729cad994f8b8fa9f2847cb5b12678ed61296521e34a1096d7fe7f3e7557481f628482341e934fb402c4c64088691568c29750b0224b88662c03a7e5abc1d5
SSDEEP

12288:Gphkb4UkUGb2vypIFcv4N01Kh8mOVFwPI+QfTopBO8ZtmczaImvEAtE9RdxpgeWn:qkbZkZb2vy+cZ1Kh8vVFUI+QfTo33Vz3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28
PID 2856 wrote to memory of 1068	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a4af142f5d13358c6f13f74aa6a5e58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a4af142f5d13358c6f13f74aa6a5e58.dll,#1
  2⤵
  PID:1068