dbb67524b25eb5fe9f96dffc84f1bddb99f444dcbb993899df0100a4e422f75d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 01:42

Target

7e8b4aaadd6223a61a254581726b80ee.dll
Size

18KB
MD5

7e8b4aaadd6223a61a254581726b80ee
SHA1

baa7173f332254a8d4a602d0d2a736d924a8da08
SHA256

dbb67524b25eb5fe9f96dffc84f1bddb99f444dcbb993899df0100a4e422f75d
SHA512

eb2de40356d2046da44bec78a957872b704467cae4853f6d6829cce0f5e2977a132244dc6b4b29dee49f66307b6ac3be124d54db4a33bd573b2cd38740afeb3e
SSDEEP

384:1CgPU85+fZA0srLBTQ6ObER3HzlqFYQfs96/dXcXRuCtpN:1e8p0uVTYwxRqF46/dXcYCtH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28
PID 2248 wrote to memory of 2080	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8b4aaadd6223a61a254581726b80ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7e8b4aaadd6223a61a254581726b80ee.dll,#1
  2⤵
  PID:2080

memory/2080-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2080-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download