73c68926e4fe82de212c2877a06e3f49fe3df3432bd01078f6bb35e3fc5c5889

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 03:12

Target

ad8a613a838597652c87ad91f466d407.dll
Size

33KB
MD5

ad8a613a838597652c87ad91f466d407
SHA1

09deabd1d8e2aff74e29d45ec25baf30274d6db0
SHA256

73c68926e4fe82de212c2877a06e3f49fe3df3432bd01078f6bb35e3fc5c5889
SHA512

d1814e6624ad5e16891ba0479f35906604d40904bfdb218a5f1dbf6106de38569256cebdb8506ba3f7bb7371ac505cccfc99a8efda0904d34b8fcb8998eaf1a8
SSDEEP

768:K2M61pGt+eC8IIklhlM7gQ/WSIUt5hnDqs6rRx3LYP5:K25LvSIIkrO7gdS1Xh2s6RxbA5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28
PID 2780 wrote to memory of 1972	2780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad8a613a838597652c87ad91f466d407.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad8a613a838597652c87ad91f466d407.dll,#1
  2⤵
  PID:1972