e6ff0b90662e2720c18345c30722ee6128c27dcc85acee4d8ee9c785b9bc44ff

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 10:32

Target

irk.dll
Size

32KB
MD5

6e1f66b487f1a8fc7d804f86c226b19d
SHA1

13ee1349f2535bb1f6c6dfa31e53bd7b6a336224
SHA256

05a6e3c6d1ce2a1554e01398f51b81b8b18fd8628d20cf04dc47595847508b01
SHA512

1feb237da33e765fc620ca30e5c56591e8c2ccfd2e815be5b40574c85b2611cbe9cea0be46867137712a15587c5e344dd0efb5378e768cf2157252bcc23b415e
SSDEEP

384:zB4aK3S3d0wL+9iQEkG+cHuKFT3phU8klbParh+lnu6EDHJRDarx1/NC7vyd1q/1:zM7inkLcOcNhD8LQGnTEDXDN7vyq1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28
PID 2768 wrote to memory of 2816	2768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\irk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\irk.dll,#1
  2⤵
  PID:2816