f97d4a8e363e28d8ae69f80314901ff80b893e05ec3a1c8c3c1d9cca0147b41a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 09:00

Target

7f6e09ef454f70547640bb1b7e58c4f8.dll
Size

17KB
MD5

7f6e09ef454f70547640bb1b7e58c4f8
SHA1

a58e280dbcd375ccf0b57b7ee44a00b16e0ecc56
SHA256

f97d4a8e363e28d8ae69f80314901ff80b893e05ec3a1c8c3c1d9cca0147b41a
SHA512

5e5e63765a1d2edc4fe6c4517efec6f03efcced8dd6ae7a1ce7be2f183dc52e44d416586fd783087af40a7fb82870457dafae022ee6feef511b9697518a2b996
SSDEEP

384:LWSFaWrAOef9iOHxgBPfHkDDupz+I1vgN9YGqMtGaW4loHXr0zJuzUhj:VP3WJHxw3HkDDuV1GqAGaWUoQzJZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28
PID 2008 wrote to memory of 2160	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f6e09ef454f70547640bb1b7e58c4f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f6e09ef454f70547640bb1b7e58c4f8.dll,#1
  2⤵
  PID:2160

memory/2160-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2160-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2160-2-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2160-3-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2160-4-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download