2f5f58469d030ff5b8879940f5f6676aedfc2ad1116a9dde79f178e18147c0d6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 13:27

Target

7ff37c021d6d94eb16d8d0f6b829f931.dll
Size

36KB
MD5

7ff37c021d6d94eb16d8d0f6b829f931
SHA1

62c5a61fc4f9431f655f0be45d92caa44b0a7be3
SHA256

2f5f58469d030ff5b8879940f5f6676aedfc2ad1116a9dde79f178e18147c0d6
SHA512

72d04b02b162c84d908cf3b3d5862ad414e9e81daf47ceb9b61fe10843a0864d5659883ff9f4ec8699c163a270cb6f46aeed7f34228545ff6a2053f04e708778
SSDEEP

768:CWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:J1lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28
PID 1768 wrote to memory of 1956	1768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff37c021d6d94eb16d8d0f6b829f931.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff37c021d6d94eb16d8d0f6b829f931.dll,#1
  2⤵
  PID:1956