9bad12516939bfe173fe12bf5a40296d333d238ffcf0e04b8e8e575898ab1409

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 03:20

Target

a0d0a4dadaabce0b5b19a26e76ef6342.dll
Size

6KB
MD5

a0d0a4dadaabce0b5b19a26e76ef6342
SHA1

358641708e2b175db14062a53d05afe6be1ae9e5
SHA256

9bad12516939bfe173fe12bf5a40296d333d238ffcf0e04b8e8e575898ab1409
SHA512

7911751b5cd5a27a0f0f650dd637b574eeddd9fed59d30aa75539a7e1dfa7de360e6a10bb1179646b27d4974a527f18c02f603db532cc05f258126317a37cd50
SSDEEP

96:oLjb5WRms5GP+b7rSJhlgk14FPPR2/9eVL8LbhU4XalkgcwQwTp4a2H:Gb5WL5++b7rgh4P2QVL83IkgUw9W

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28
PID 2196 wrote to memory of 1752	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0d0a4dadaabce0b5b19a26e76ef6342.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0d0a4dadaabce0b5b19a26e76ef6342.dll,#1
  2⤵
  PID:1752

memory/1752-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1752-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download