559da6badb2092d46a96dc0ebc7419c54876edd78fa4f14837c822db88ec5332

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 11:15

Target

7fb3c7e32f84d7720ca78e9bfc7f8224.dll
Size

57KB
MD5

7fb3c7e32f84d7720ca78e9bfc7f8224
SHA1

2ee723cf67624121f9d942c1328e90d27b4e593c
SHA256

559da6badb2092d46a96dc0ebc7419c54876edd78fa4f14837c822db88ec5332
SHA512

97b202c78ad4b75510918c39eb2a4dc38a92e26fd40b5f74efaa7d51f7c713839783c22b7b828de86451acb33322fc95af78a5fd83dd8ae6bb96626fdeb5f98e
SSDEEP

768:HnPIspNqsKap/K/U26go3UTRRYOoMoBb9CF5FoayLfcT2awAaVB2cqR:vQO5Kc1kTRRYg8m5FoayoT8A0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1244	816	rundll32.exe	14
PID 816 wrote to memory of 1244	816	rundll32.exe	14
PID 816 wrote to memory of 1244	816	rundll32.exe	14
PID 816 wrote to memory of 1244	816	rundll32.exe	14
PID 816 wrote to memory of 1244	816	rundll32.exe	14
PID 816 wrote to memory of 1244	816	rundll32.exe	14
PID 816 wrote to memory of 1244	816	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb3c7e32f84d7720ca78e9bfc7f8224.dll,#1
1⤵
PID:1244

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7fb3c7e32f84d7720ca78e9bfc7f8224.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816

memory/1244-3-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1244-2-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/1244-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/1244-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download