139d27cb20a1b3d9a428d3cd4ccfdc74bedfc3af842791ae6a37198d37ab863d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 12:29

Target

996e2f2c5ef24f48c3c847df9129f205.dll
Size

175KB
MD5

996e2f2c5ef24f48c3c847df9129f205
SHA1

1199a98fe20883560f42cf8ae9c5ec1bf13b1e6b
SHA256

139d27cb20a1b3d9a428d3cd4ccfdc74bedfc3af842791ae6a37198d37ab863d
SHA512

0329118a1f4d229177aa6aa94f1ebd585c96149cc4ffad072770fd4252cd208eaf72f883730bc849d300ffea519a71d453dd4a5f7d2dfed5824fd7d66417c55b
SSDEEP

3072:QkMRaAl74a92BdwTafvN2+JgpkV6sGMdMZ2mouRTvYd:ERaAx4aodwivkD8fmouRkd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28
PID 3004 wrote to memory of 1648	3004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\996e2f2c5ef24f48c3c847df9129f205.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\996e2f2c5ef24f48c3c847df9129f205.dll,#1
  2⤵
  PID:1648