86efbb9ba722a9a959e04a6a6362ad8ede1c00aefcd87ce8772d63b8d08873c2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 04:10

Target

aaf8ae6fe9c9ada4908751157392b4fa.dll
Size

31KB
MD5

aaf8ae6fe9c9ada4908751157392b4fa
SHA1

e4500c05be6b040b27c1f1284a5fa85475007264
SHA256

86efbb9ba722a9a959e04a6a6362ad8ede1c00aefcd87ce8772d63b8d08873c2
SHA512

d44914c14dcc3750250d797b906a8b9c443a48cfcaa09cd92ef9f3d072664c05c9f7d0a0aca6fbbc944140e8963e8d7b220821718b522215755b259c479bff73
SSDEEP

768:oPrFRBtgY4T8JVkhTRfQWZRDs59KIjZJkJViv/Aqs9jq:oPJRBO58J6cWZts/p3kbrx9jq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28
PID 1736 wrote to memory of 1932	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aaf8ae6fe9c9ada4908751157392b4fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aaf8ae6fe9c9ada4908751157392b4fa.dll,#1
  2⤵
  PID:1932

memory/1932-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1932-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download