96897dcd1f887f017088db8a0f0d6b3e0e52bc688bcc3e346269996865ebe377

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 08:48

Target

a171f46b70e63990e8ac2e29cd8b54d2.dll
Size

13KB
MD5

a171f46b70e63990e8ac2e29cd8b54d2
SHA1

ec752fd34d0e304cb37f42ce7da1faf66da26cc5
SHA256

96897dcd1f887f017088db8a0f0d6b3e0e52bc688bcc3e346269996865ebe377
SHA512

6388bdb0960048f8530ce66867c0abb0d29d551ccd54294bf019bc356a5fb3e691d02362a1fa5bac549135ca63fbcde7d8431c258027621a6475b4bc4e7c0516
SSDEEP

192:ndW0u8/Jh0Dl532eJWao4i/3Z9P8IXoNEPRB8fENKFV1NSCWcWQes6tAv4C5:rvL0532e833cIXEx8REnR3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28
PID 1996 wrote to memory of 2212	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a171f46b70e63990e8ac2e29cd8b54d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a171f46b70e63990e8ac2e29cd8b54d2.dll,#1
  2⤵
  PID:2212