4df03a4fecfdb9aaa8dc9652f886e0f4aaea32d10e35d258c2bef513eb97da74

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 06:04

Target

7c5695092b10c02007fc5407cf245501.dll
Size

11KB
MD5

7c5695092b10c02007fc5407cf245501
SHA1

0b8bfd5b2e30564a81cf42caa71e956be1ef2841
SHA256

4df03a4fecfdb9aaa8dc9652f886e0f4aaea32d10e35d258c2bef513eb97da74
SHA512

c102f235f8fb9386b67c58b9c708771cfbc18b32a91d10b0102e1f0138361f92b52567a34e8c0b4e915aa11bf7fee2e44064ad964b39b7dcef8e63f1152e5143
SSDEEP

192:wyofla5f9UcsTzm+7ymPuEIG2ttJLhmanSYNhtofP:Rofla5lUcgzmmpPJIGMxwhCr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28
PID 2412 wrote to memory of 2420	2412	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c5695092b10c02007fc5407cf245501.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c5695092b10c02007fc5407cf245501.dll,#1
  2⤵
  PID:2420