92d937ea168fec8d2b82141a024b2022bdf6106bf42ccfbbf75d4144ff8320fe

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 15:14

Target

ac308305ad8ff8f174e21be6c5ffbd75.dll
Size

85KB
MD5

ac308305ad8ff8f174e21be6c5ffbd75
SHA1

c3e4ab3096f38e08daab2b5ee141e1490ce8f2f4
SHA256

92d937ea168fec8d2b82141a024b2022bdf6106bf42ccfbbf75d4144ff8320fe
SHA512

5722f60b7d30c3a754e1684aa3d03dff718650313dcc66cb98a1000d02e1438cd2a0388f402851430d81d346585b205a0010e3ad010a4909d5851721d6fc5b8f
SSDEEP

1536:0pstl9F0gv/r7r2ZGUjRN+NJDSDuJqpOeC6PsNbjWfNF/Je4a4tW:0OtFNv/r7r0G2RwNwDuJqFCusNm049tW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28
PID 2128 wrote to memory of 1816	2128	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac308305ad8ff8f174e21be6c5ffbd75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac308305ad8ff8f174e21be6c5ffbd75.dll,#1
  2⤵
  PID:1816

memory/1816-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download