6e4c6e8fcee2d72021ce2a9621614c7919ae71133d1a355365d1b1a21579d51f

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 13:58

Target

9dbe815e1095f14671ba41aefcaa7a6b.dll
Size

935KB
MD5

9dbe815e1095f14671ba41aefcaa7a6b
SHA1

ebc5eafbde6bce3d6829b322822dc5a2755778bb
SHA256

6e4c6e8fcee2d72021ce2a9621614c7919ae71133d1a355365d1b1a21579d51f
SHA512

79fa9f70c49d39db9b9031471ad18d3614c6bbd50e04f96b73920bc22362d3a3ab7bb5764bb66ec67f28b8afbeea65c8845ff28fdd34e79a90627eb403947f6b
SSDEEP

12288:2qOfdYcwbu2jfQXSw7iDDVScHBsgVitfm5tltS2cevnXi1I09sjjGEzU3A:Vs/ONf1w7sw8s9whtSVCXWs/GEgA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28
PID 1816 wrote to memory of 2080	1816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dbe815e1095f14671ba41aefcaa7a6b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dbe815e1095f14671ba41aefcaa7a6b.dll,#1
  2⤵
  PID:2080

memory/2080-0-0x00000000002A0000-0x000000000038E000-memory.dmp

Filesize
952KB

Download
memory/2080-1-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/2080-2-0x0000000000390000-0x00000000003C5000-memory.dmp

Filesize
212KB

Download
memory/2080-3-0x00000000002A0000-0x000000000038E000-memory.dmp

Filesize
952KB

Download
memory/2080-5-0x0000000000390000-0x00000000003C5000-memory.dmp

Filesize
212KB

Download