77313a6e9d32197f51ba43c581942a4e7875284a8d9b40db290c7827d9314c00

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 07:11

Target

b41acaa77d2607c170ae65ce92e89037.dll
Size

110KB
MD5

b41acaa77d2607c170ae65ce92e89037
SHA1

6dfa04ba838bd0460c802ec9372ee0cb62257621
SHA256

77313a6e9d32197f51ba43c581942a4e7875284a8d9b40db290c7827d9314c00
SHA512

43bac4ac3fda09f8764eeb713f1cc92d31ea643b0919247a9eac1000514fc383febd01ef614decfe7b3a85ce33e6f6ea42e5398c849650152b9a25e225c7333a
SSDEEP

1536:aIXbIMIqkuvfZ/AuwTVxsKDjirfmWHfqeyqkaUiqvic8fO89:a0fxxvfGTVaCkiqRue

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 848	1408	rundll32.exe	28
PID 1408 wrote to memory of 848	1408	rundll32.exe	28
PID 1408 wrote to memory of 848	1408	rundll32.exe	28
PID 1408 wrote to memory of 848	1408	rundll32.exe	28
PID 1408 wrote to memory of 848	1408	rundll32.exe	28
PID 1408 wrote to memory of 848	1408	rundll32.exe	28
PID 1408 wrote to memory of 848	1408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b41acaa77d2607c170ae65ce92e89037.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b41acaa77d2607c170ae65ce92e89037.dll,#1
  2⤵
  PID:848

memory/848-0-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download