5bb2652fcf6415c541609901a2aee9991ed51934e76d1f8721fe3568524079bd

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 13:25

Target

VirusShare_6bb311d068ff7731a70061a4e5b88e59.dll
Size

46KB
MD5

6bb311d068ff7731a70061a4e5b88e59
SHA1

c44680faab426957fb996d1a4a6b4f4e601a1925
SHA256

5bb2652fcf6415c541609901a2aee9991ed51934e76d1f8721fe3568524079bd
SHA512

41e5b79a823896d520a609e7699bfe7f651fe9c18101f659ca6be7e2ddff12837e07e5f1c3c38a9228e7d12e55d32847f4368cf986502e0fa9c090bc68340556
SSDEEP

768:CBXZ8QJhVxyOeO0w2UsKkgD8Z0n+n78rZDPUKXmSwmwC41/n7m:gr9d2wHbrZD8SY397m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_6bb311d068ff7731a70061a4e5b88e59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_6bb311d068ff7731a70061a4e5b88e59.dll,#1
  2⤵
  PID:1288