001dadba99c7a1039ca8ee011a26dd053006f8c70887b43b900b80b93e0b1b41

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 22:52

Target

ad10454c965947a3658bb553ef009337.dll
Size

42KB
MD5

ad10454c965947a3658bb553ef009337
SHA1

f4ac2bef8e518fe27f69a04ecaea76e9137b2fd3
SHA256

001dadba99c7a1039ca8ee011a26dd053006f8c70887b43b900b80b93e0b1b41
SHA512

57c3c35afab3996b0e3e71fb001d78e0768b07ff29bb6f99535b9b64bfa980b936dab7bf8f13846e215ac124df60db08e071a7152fad4a1affc1e72e4940cfea
SSDEEP

768:s5TT7I1Nyc8Jxazo9olmzxjNfFhNGpWTZtThZILvks:s5TT7akpKoHFhNGpWTrhZILj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28
PID 2192 wrote to memory of 2012	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad10454c965947a3658bb553ef009337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad10454c965947a3658bb553ef009337.dll,#1
  2⤵
  PID:2012