b4057bf35e38d9754f8ca6178353ea91775c6218d76eefbbd9c8c4475cff2f98

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 13:54

Target

9996bc7eca4e9857fc7634921f2ad114.dll
Size

512KB
MD5

9996bc7eca4e9857fc7634921f2ad114
SHA1

65cb888a376988e791787ba1d26a1106b904f2d3
SHA256

b4057bf35e38d9754f8ca6178353ea91775c6218d76eefbbd9c8c4475cff2f98
SHA512

19ddc56060a6aecbefb30ff2decc96c7eaf514da0280cec05db3f2e2dcc44d80671c78b8cdda6481d74f866b0d399ed68efe77dfbc41dc5c685f94087d9164ee
SSDEEP

6144:GDmqfUahcpqGvMcrSQxZr2ITbktSJ+Yishyc4WZnHDRFTPmkmXfXQT34G:ifLcpqG0HQeKZsz+ZnHlN+bAH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 1724	1788	rundll32.exe	29

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1164 wrote to memory of 1788	1164	rundll32.exe	28
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29
PID 1788 wrote to memory of 1724	1788	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9996bc7eca4e9857fc7634921f2ad114.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9996bc7eca4e9857fc7634921f2ad114.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    PID:1724

memory/1724-0-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1724-2-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download