e56296cd62cb9eb4d5be601225b5c88b84f035ecff5b8ef9080b8ffcb21953a6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 10:08

Target

8ee0f519b1e26ce6d9867f995c95dc0a.dll
Size

60KB
MD5

8ee0f519b1e26ce6d9867f995c95dc0a
SHA1

a681386edd37e839cb4fb99554cd03b7fadabb95
SHA256

e56296cd62cb9eb4d5be601225b5c88b84f035ecff5b8ef9080b8ffcb21953a6
SHA512

951e1a55d3847ad189d7664d1ee29d8de1b0c4d594b4e52b5496b4d6542f2eadbde77286d3afe88a1ebb1b264ee1cd0e30cbc87d6afb4b6f7204aa9a4b3a978f
SSDEEP

1536:1O6IGuFAShavUXaZsJRzYScyB13yPDc1LSNPbE6HvJLmgPaf5:1tsXaZ0GS7HCPDuLSNPJLbSf5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 864	2724	rundll32.exe	10
PID 2724 wrote to memory of 864	2724	rundll32.exe	10
PID 2724 wrote to memory of 864	2724	rundll32.exe	10
PID 2724 wrote to memory of 864	2724	rundll32.exe	10
PID 2724 wrote to memory of 864	2724	rundll32.exe	10
PID 2724 wrote to memory of 864	2724	rundll32.exe	10
PID 2724 wrote to memory of 864	2724	rundll32.exe	10

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ee0f519b1e26ce6d9867f995c95dc0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ee0f519b1e26ce6d9867f995c95dc0a.dll,#1
  2⤵
  PID:864