7eda3d14a495f50330c039409860aa3e37e5067893cc412df2838ed4b6c89c80

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:56

Target

7cd2ad9a7e0d5bf21591f5e3a5c7f0ac.dll
Size

146KB
MD5

7cd2ad9a7e0d5bf21591f5e3a5c7f0ac
SHA1

d4a8eb4fd78c64b85b9fcfe5c61f18ef2c55f6cc
SHA256

7eda3d14a495f50330c039409860aa3e37e5067893cc412df2838ed4b6c89c80
SHA512

909dcda4b218512ee5506bd4a38b2ca110dcb83173d125404f8385097bdc4670b1268a669a20207ce5b17ef52189d63dae7b7683cd8dccdc02c517f3bbb85a25
SSDEEP

3072:ojbg9fiLyNagtH7EiIOM7ztJvIvdPHqhZh4W+JJP0VO1hyEY0KEqA5V49RzKdhJN:ojyf977cpmuM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28
PID 1708 wrote to memory of 2040	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd2ad9a7e0d5bf21591f5e3a5c7f0ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd2ad9a7e0d5bf21591f5e3a5c7f0ac.dll,#1
  2⤵
  PID:2040

memory/2040-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2040-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2040-2-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2040-6-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2040-7-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download