1f410b89cdbf3e5a0b000bd81708839d6a06a6c1e6af6cb560ede8854a6c4664

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 05:26

Target

98967c02969740487b5c59891189ffba.dll
Size

44KB
MD5

98967c02969740487b5c59891189ffba
SHA1

2f0014acd5531dacace84db2d356a170822e2753
SHA256

1f410b89cdbf3e5a0b000bd81708839d6a06a6c1e6af6cb560ede8854a6c4664
SHA512

8aae595b573d3c4b776fd3154cda7673952eed4a0768f4f3aef66098a1f16974ee020b096e4dc141af45df0be5124fe4e0d1e749d1a89394167b65b5acbd4e8b
SSDEEP

768:5aqcMRm3MRNtUdL8jfnMhbanF0lUSSYRt212fUrHq/wAZ7lwSwEPHoISlY:514fL8jf7nEUSXRt212MrHq/wAZ67EPo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28
PID 2496 wrote to memory of 2256	2496	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98967c02969740487b5c59891189ffba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\98967c02969740487b5c59891189ffba.dll,#1
  2⤵
  PID:2256