961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 06:33

Target

961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e.dll
Size

2.1MB
MD5

a174b62233cd02fcc2a05ab3d01cc23a
SHA1

5150667a899bfc1fa97868a87e07fa6a14442a7c
SHA256

961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e
SHA512

0d2b1814146623ca81b50b72aecb8cf8ff727b8e7da0cfa38880e69f184788e8be633a28c4b01aec5012e927db690d4280e64a112b271b961f493614de53ac97
SSDEEP

49152:sTIC9xRNavXa57okf/86lVijDRy6OTyZMWZ85X:KIAxfafae2mDRdZZ85X

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28
PID 2068 wrote to memory of 2684	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e.dll,#1
  2⤵
  PID:2684