7e2e73d61f984ef937887204bce3be85ce2cce74f270a92c5e8472a74855a20c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:34

Target

9a16a4b9ba549f67afd971c4e9747bdb.dll
Size

33KB
MD5

9a16a4b9ba549f67afd971c4e9747bdb
SHA1

0db930d722256e128eef63a19bc3db4d91bc965b
SHA256

7e2e73d61f984ef937887204bce3be85ce2cce74f270a92c5e8472a74855a20c
SHA512

06f08bdfd07b45bd30ec5df578acdda014cbefc2ec0d6d63b3c56735da7f69165cbcadaa590060082db0a177b35d99eb68bf349a1c2d9a6a2317a602d1f8821c
SSDEEP

768:s8pjghrK5eEOyzNqi9UHjA7Vsc7vHFT35hcDCsjpRZddFI:s8pjarK5eNH8X7vlTpCusjpRzdW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28
PID 1016 wrote to memory of 1996	1016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a16a4b9ba549f67afd971c4e9747bdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a16a4b9ba549f67afd971c4e9747bdb.dll,#1
  2⤵
  PID:1996