6fa8711d87082296e05cde22960f0dac200d55125326e66783a0b4a2205f8c58

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 13:25

Target

7ff2b120afb76ec7bbea509e7a0b74b3.dll
Size

29KB
MD5

7ff2b120afb76ec7bbea509e7a0b74b3
SHA1

fd93ead3c68d144a0fcf7b949ba05908dff29c65
SHA256

6fa8711d87082296e05cde22960f0dac200d55125326e66783a0b4a2205f8c58
SHA512

40a96408be0ded53e221760da29553d4c972db5d6f90163a4c85d4c457100434284022e2ad4b9132bfd79ce846488742c55e9338858c03fa50ed5e0c49c156a3
SSDEEP

192:6M+ww1b4KcJCHWtteIWhKSxC+ebCf3EkQpkqs1IPMyowJL/NM:Wb4XYWtYIWFx0bCf1qMYJL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2152	880	rundll32.exe	28
PID 880 wrote to memory of 2152	880	rundll32.exe	28
PID 880 wrote to memory of 2152	880	rundll32.exe	28
PID 880 wrote to memory of 2152	880	rundll32.exe	28
PID 880 wrote to memory of 2152	880	rundll32.exe	28
PID 880 wrote to memory of 2152	880	rundll32.exe	28
PID 880 wrote to memory of 2152	880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff2b120afb76ec7bbea509e7a0b74b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff2b120afb76ec7bbea509e7a0b74b3.dll,#1
  2⤵
  PID:2152