cb6eb8a9e55892c41d3fa63dbe365b2218c21d2d675daaba17c6ca9e58f15d1c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 11:59

Target

86d64e2c01259150f691aec0d189dd9c.dll
Size

66KB
MD5

86d64e2c01259150f691aec0d189dd9c
SHA1

37c318f280bf19e5c301c6b3caac0fa276939ec3
SHA256

cb6eb8a9e55892c41d3fa63dbe365b2218c21d2d675daaba17c6ca9e58f15d1c
SHA512

25f1c731736343076ad374e4b3a23f442b3025d396dd19c91045a44aa4644b9d446f817ba330c14e9a76a88468361eb6702596553377c1ee2048feafeecc47c9
SSDEEP

1536:XeGhUZS1tJXNR7LC3hA80ttyHP7/0bnqybnT4osxpGKuZ:uYUqR7uokP7cbqonT4XKZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28
PID 2028 wrote to memory of 2544	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d64e2c01259150f691aec0d189dd9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d64e2c01259150f691aec0d189dd9c.dll,#1
  2⤵
  PID:2544

memory/2544-3-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2544-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2544-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2544-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download