b963ac73fa4c505720004135ac5f91d22213c85c9ee38ebb1d80d5f8a41ab81a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 09:24

Target

a1817103aa605b22f88aa6f041cd29d7.dll
Size

82KB
MD5

a1817103aa605b22f88aa6f041cd29d7
SHA1

a5e5743c123bc7d2b9405938d7b121962d42b663
SHA256

b963ac73fa4c505720004135ac5f91d22213c85c9ee38ebb1d80d5f8a41ab81a
SHA512

e575977141526c57632983e09adb67853236fd90097dc587a65ca44eac8493b38930f553548257edfbb811bbfce0a4429e41aaf8f40fa60df2600c2be0ddf306
SSDEEP

1536:M2PM8TDxdGctNH9ouKBnx/3uKoWxrcBmKsDeiL3tebHf7WNRj:1PMqDDEnZosrcsKzcAbzM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28
PID 1936 wrote to memory of 1040	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1817103aa605b22f88aa6f041cd29d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1817103aa605b22f88aa6f041cd29d7.dll,#1
  2⤵
  PID:1040

memory/1040-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1040-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1040-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download