a212fff15d17a1d4fafec632a0ab4ba82fcc1642bbf0976d5ee4351190aa9df3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 07:23

Target

a333e6edd090077f20fe305d4808851d.dll
Size

24KB
MD5

a333e6edd090077f20fe305d4808851d
SHA1

f779278f3b247c898df7b499060884fc232863d0
SHA256

a212fff15d17a1d4fafec632a0ab4ba82fcc1642bbf0976d5ee4351190aa9df3
SHA512

563c75c00a89bc4445d6b17685a3b78bac5deff372b2fd77f81da736e7c1cb4f5ab671c5fabb4af60bfd2592b764655ca77d59cb1bd914c6126b9e3cd3420382
SSDEEP

384:rBPIGSmm43lAqCwL1a/apAVbOjpo9qYlukHu2bmqlO72Z6KH47wY0jM:rBhk4c0+VbOjpnk7HQqJ9uq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28
PID 2000 wrote to memory of 1612	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a333e6edd090077f20fe305d4808851d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a333e6edd090077f20fe305d4808851d.dll,#1
  2⤵
  PID:1612

memory/1612-1-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/1612-0-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download
memory/1612-2-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download
memory/1612-3-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download