ddfc80c6e5a3d625cc5cc2af348e2c8175a2bac43c127347d466fec5016bffe3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 17:26

Target

8cea81fa712d70907defd56627eb59c6.dll
Size

45KB
MD5

8cea81fa712d70907defd56627eb59c6
SHA1

9dfa58a0bc3904d53b75a72df86fafb478fa2af4
SHA256

ddfc80c6e5a3d625cc5cc2af348e2c8175a2bac43c127347d466fec5016bffe3
SHA512

27407504a4e3be3d0295dab4debd7399df5d9eda1d0fbb5afc0862a7142215ba4986e60688b11f0fd9a0af8dc5476b97d11b42859ef71b1db60f1e59f10383f4
SSDEEP

768:WBmpM8pxLxh/0oQ3F0TCjMAWuU+/h4Cqq+hvA/az/Hm4yKekV+qmMckCf:WBaHtmQCj/W3pvZ9bHgqB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29
PID 2168 wrote to memory of 1548	2168	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cea81fa712d70907defd56627eb59c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8cea81fa712d70907defd56627eb59c6.dll,#1
  2⤵
  PID:1548

memory/1548-0-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download