ffe35206b8181f950b3b4d4d1793099fda9b204052b11bd7d095b93c2929854a

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:52

Target

7cd1116fdd6dae04df634be24dbfaa4c.dll
Size

30KB
MD5

7cd1116fdd6dae04df634be24dbfaa4c
SHA1

cd979779df047a428693b286014f7e3f64ca3a70
SHA256

ffe35206b8181f950b3b4d4d1793099fda9b204052b11bd7d095b93c2929854a
SHA512

14a6a0debd4977695f1c47855bed8e7212a258d4967aad554eeee1ec65545f317501d60e12bcf5b5adf3b3ce6f9a828b20638e984e0cee0ff8475749b3121502
SSDEEP

384:tdiKGP+YRN8AnRfAysZwryoHBRV8//1poUbGlLWhduVIviXNfg+Sk8h8A2x3MNvv:m3Pjg2R4BS+gG//K8zvidY+N8h8BFM/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28
PID 2428 wrote to memory of 2448	2428	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd1116fdd6dae04df634be24dbfaa4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd1116fdd6dae04df634be24dbfaa4c.dll,#1
  2⤵
  PID:2448

memory/2448-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2448-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2448-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2448-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download