79e5c48dd4d75d2aa224ea05cd5c115c9cb4e2acfac13dd30082a018dfc4f033

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 19:00

Target

87a5bbdf4315c1b4c6128e872fb8869a.dll
Size

237KB
MD5

87a5bbdf4315c1b4c6128e872fb8869a
SHA1

0a0fd4dd9c697b4974ad2d865acd652d426334f8
SHA256

79e5c48dd4d75d2aa224ea05cd5c115c9cb4e2acfac13dd30082a018dfc4f033
SHA512

93654aff69d64958872d4a9af236b4e0fa9aae8ecd0f115e6f912279c7c16413a02cde9c7bda466c67c9217b859a717607177dce350c4e3c03d7b098ef36e92f
SSDEEP

3072:fhv+G0K/6nyCkdEt7bvaUOAfYVLaTh/NRY48+iya7RPCkxSeZ3XPEQNkaS:f1AyCkdEt7bvaUd+LSX+yaN6kRZPEZa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\87a5bbdf4315c1b4c6128e872fb8869a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\87a5bbdf4315c1b4c6128e872fb8869a.dll,#1
  2⤵
  PID:1704

memory/1704-0-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1704-1-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download