e6670e08610b9cbcd9e202fdf8f428a7b259372cb970c82d43f8e7fe1340f357

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 15:08

Target

8ca46498c5bd9e535db94c11eed2ef0e.dll
Size

36KB
MD5

8ca46498c5bd9e535db94c11eed2ef0e
SHA1

07642785b113798eaffe3ba4f8101e24a4622456
SHA256

e6670e08610b9cbcd9e202fdf8f428a7b259372cb970c82d43f8e7fe1340f357
SHA512

9a70a5af68520b3091e5f9d26a2ff01157af05d91525f982969655e4d077a2fee9b2fbbee3a58bf93711be71d8ad1d624ae1a554a2948de952147432bbac145f
SSDEEP

384:ccQ0phDcUhyrdqwz45o+6RNl2vnY5QlShPShzT8KKPnZarwJ/fHxNZmsI4Co59cQ:ZphD0QORHEYvhPAHQnZa+t5I4r+MurR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28
PID 2060 wrote to memory of 2396	2060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ca46498c5bd9e535db94c11eed2ef0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ca46498c5bd9e535db94c11eed2ef0e.dll,#1
  2⤵
  PID:2396

memory/2396-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download