ee99c20098af38833fdb9fbe5f259ea9ce6b066bf69a814e6d653536a65c8753

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 09:20

Target

96cfe84e41033355b016bf38e1c83603.dll
Size

756KB
MD5

96cfe84e41033355b016bf38e1c83603
SHA1

2f877921688cd801681e40aa9cb51052b56b2348
SHA256

ee99c20098af38833fdb9fbe5f259ea9ce6b066bf69a814e6d653536a65c8753
SHA512

efd986604ebb96756c6fd5a4fb50bd14512ee6773c7f288ba3418707e76b11aa4e1755afa875e7ea6f643063ec2f73ca74c2ba45b13826b399515fc608dc9250
SSDEEP

192:pPqs9lAITs65IONxoS64r8kLkpLcvAdwktGXJVqzAXXdOsoi9qNq/pH8yosZ5ZDQ:pP/P7NS46dASuMi9qNqN8yvV+5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28
PID 2000 wrote to memory of 1708	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96cfe84e41033355b016bf38e1c83603.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96cfe84e41033355b016bf38e1c83603.dll,#1
  2⤵
  PID:1708

memory/1708-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download