72dada868d1a5acd05d9de4ce18493c81487d804729d2916da3351022a221a55

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 08:20

Target

98eeef9c52f7aec4f7ad3a7e08c56916.dll
Size

119KB
MD5

98eeef9c52f7aec4f7ad3a7e08c56916
SHA1

1c7d739a2bec5e8331ddd6cb0b4c7ee5c378ac86
SHA256

72dada868d1a5acd05d9de4ce18493c81487d804729d2916da3351022a221a55
SHA512

70e026e017477ce2cc1a22fd94819d8b33a9348b04a82895de2ff631dc2a42ebc5245d6569cfa0072b78c77cb7eeb831768c359f6672e2d3a576e626d65d3657
SSDEEP

1536:LSlvNYnd2uvHiMZsc8m63xaLom4CJNhNhUzzQcKN2+2gfGrNQtta3z0vgPzi7w99:kindHOcToRy6zzfKNd4NbygP+7eJf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28
PID 2956 wrote to memory of 2788	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98eeef9c52f7aec4f7ad3a7e08c56916.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\98eeef9c52f7aec4f7ad3a7e08c56916.dll,#1
  2⤵
  PID:2788

memory/2788-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/2788-1-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download