b4873ade58e22893042b36bdd7c1a3316364b6ddf52952117b0975f5237cb9cd

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 13:10

Target
libdl.dll
Size 17KB
Sample240224-qephrsdc7v
SHA256 e1646c7778c24407a17881908037a49ecfcb5a980d155212d544302653a3ef62
MD5 ed925bdab51f49813686b62eb82fb4a4
SHA1 bc7c742b92a5b47089e0b400a8a80bb217e775fe
SHA512 5be99a6b0e2091fe37ff50d5a9c4fa789db27b5ba108801e4d18e99ae584ae1bc91ba3339916dff8a323155815e660f43ca54ffcc7c14c1e3f90600aedb54bd8
SSDEEP 192:9oqX4Maf/9pG1cBQS6YEn8+K8fZkkLGM2u5YiXNDTPsd9/9ZidfuOiSLU8:9XX4My/9pG1cBQS6nb6kqu28wOY8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28
PID 1908 wrote to memory of 2324	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdl.dll,#1
  2⤵
  PID:2324