5b3dd924c31660317d16a2e9bcaa3620a8be83ccaa401343e8c5d9f32c9fa18c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 08:53

Target

7f6a8cc62874a72f2313cae0a5917e3d.dll
Size

725KB
MD5

7f6a8cc62874a72f2313cae0a5917e3d
SHA1

02d409d9a8b1862ace4169535fd81d6836f7001a
SHA256

5b3dd924c31660317d16a2e9bcaa3620a8be83ccaa401343e8c5d9f32c9fa18c
SHA512

a9abe62fc18ce5c4e616adb2cbebf133a1db9fa0af0dd12a8113c73519304649443f1914990e261fee69de2e8a6e19919f449374089fd09d68e300f69d7490ff
SSDEEP

12288:fdDdFgrymFGR++uDZ98Zx3UsbgJ5hBC5Y7W9vnUKRQMkNffItlqob1wq5f7hczF+:JdFgy6A3uDZ9e3uJ5OAqfeMUn9qz0F+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28
PID 2800 wrote to memory of 2524	2800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f6a8cc62874a72f2313cae0a5917e3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f6a8cc62874a72f2313cae0a5917e3d.dll,#1
  2⤵
  PID:2524

memory/2524-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download