73202e8d754c4cf8900775eedb4e8c9d80d6df31d8db4aa75327aa8bdaff33c7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 14:16

Target

800b4f959096fb2fb538bb12c8afacb2.dll
Size

85KB
MD5

800b4f959096fb2fb538bb12c8afacb2
SHA1

9bf6c00c65c483d79548b29f1a390b1faf68b5bb
SHA256

73202e8d754c4cf8900775eedb4e8c9d80d6df31d8db4aa75327aa8bdaff33c7
SHA512

eae55dae8c0c2e3addbc2ee6c5671e3d0120e5ea6f1f21879fbe0be72612ae3cacf8d3dbf058cf53dfcd85b265e8701a907b70cff16c552423eca074f55e45d6
SSDEEP

1536:SAVJ0mWeB/iU9D8n+uiVoU5Pli5gMqygq8XcBqkxR+OM4HDlOUw9:zJ0mW8/inq5lsgQgrmquR+IjlJw9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26
PID 1856 wrote to memory of 1228	1856	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\800b4f959096fb2fb538bb12c8afacb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\800b4f959096fb2fb538bb12c8afacb2.dll,#1
  2⤵
  PID:1228

memory/1228-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/1228-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download