79ead1a4484f61ff0b7f35ec1ca6d77f80627026fb4b5e4359a3718a5d081a34

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:15

Target

7cbbfbbcc6a436a0eeaae9c6e5ce9166.dll
Size

29KB
MD5

7cbbfbbcc6a436a0eeaae9c6e5ce9166
SHA1

199c1ff09b4ec1e5fd83998f81bfd5c213c9b28c
SHA256

79ead1a4484f61ff0b7f35ec1ca6d77f80627026fb4b5e4359a3718a5d081a34
SHA512

7a4f2e6578b27dbd56a19b20cc4e698e72a6315212824133c6a2e2c61f37d6896a3e3735c1adcf427489d3647174bd7f49dbc67d1e954a19cad2d8ef3ac47d9c
SSDEEP

384:fOuVij+KgyG0DQnMDyaweOUNMfPTDjnw6eJ9fn2hmO7MiJAhPQBuoi/Jk8F5z3:fzegCDQnMDdhN+PDw6eb8AKAhPFosJlj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28
PID 1728 wrote to memory of 2108	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cbbfbbcc6a436a0eeaae9c6e5ce9166.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cbbfbbcc6a436a0eeaae9c6e5ce9166.dll,#1
  2⤵
  PID:2108