e364f5cacedf32419c9fefe5e28ed89b76ba0502c3576b2ff69da5989df04787

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 04:33

Target

9ac388bb3b62e899aabba73869ed660e.dll
Size

100KB
MD5

9ac388bb3b62e899aabba73869ed660e
SHA1

7930fde70b5a939caaa2d3ba376cb344752e5665
SHA256

e364f5cacedf32419c9fefe5e28ed89b76ba0502c3576b2ff69da5989df04787
SHA512

0cdf28b1aa30ff24eada8947caec7f26226d40d8c8c54a4ba1e24505e4e93c95d3269afda7130bfde8cb4002c9c006d54d00feaecbd6e7f68c44b173ebfc9c53
SSDEEP

3072:88PRkz/eTpeR3S10fllonW92irBfflkcIACjg0YcYmbRIryLcfBq8kOOW:iyuaOom5qcaYJmbRrGBqFW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28
PID 2304 wrote to memory of 2356	2304	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac388bb3b62e899aabba73869ed660e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac388bb3b62e899aabba73869ed660e.dll,#1
  2⤵
  PID:2356

memory/2356-0-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/2356-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/2356-5-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/2356-6-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download