b6f7bed0939f3d3911b20c43245f8414b9783dc5d9aafbefa2576ef3959a2982

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 15:46

Target

VirusShare_62b435a5258ca3b30046523c71c8ccb5.dll
Size

527KB
MD5

62b435a5258ca3b30046523c71c8ccb5
SHA1

261eb586337e88ecfbf9de642da6880ddc00050f
SHA256

b6f7bed0939f3d3911b20c43245f8414b9783dc5d9aafbefa2576ef3959a2982
SHA512

97b23730584bf86b2de6fcd3894525a2d76a0d259ff1e3ec2288c43b43a7753558d1649c3f8ae3425df78e2b6968743452ed7882a6d21708331d973f3e3e5421
SSDEEP

768:CyYsWdhldUurbfty2zkFOFZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZt:XYdSutpkI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28
PID 2144 wrote to memory of 2116	2144	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_62b435a5258ca3b30046523c71c8ccb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_62b435a5258ca3b30046523c71c8ccb5.dll,#1
  2⤵
  PID:2116

memory/2116-0-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download