d0f00e24c700d8730f93286831d0f7f27c441d317a6288271eb7fec25792ba96

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 12:05

Target

7d13a905ae379d64925234190e6d6e08.dll
Size

385KB
MD5

7d13a905ae379d64925234190e6d6e08
SHA1

bddaad1fb7978ec386c70e56539b24eba691521a
SHA256

d0f00e24c700d8730f93286831d0f7f27c441d317a6288271eb7fec25792ba96
SHA512

7b83bd69f06b58be623feaa0cc235fedbac2835621fe45d450acb0f3a1fd216d354135075155f0a16d6658743f14fb5639d25a892aa65d14d4fa63020cf8c202
SSDEEP

6144:LCUhoDRL+MO+CpdG2LpCa6dioytdmcDAWgdwBiGD5JeQN2DrWxl:QD4MO+CpdGByPmcadGtxN2HW/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28
PID 3028 wrote to memory of 2116	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d13a905ae379d64925234190e6d6e08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d13a905ae379d64925234190e6d6e08.dll,#1
  2⤵
  PID:2116

memory/2116-0-0x00000000003F0000-0x0000000000455000-memory.dmp

Filesize
404KB

Download