c0c41aa0dfc14cc2c882f311841368559b75a38fe5ab1b6d13c5ac3a107f672c

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 08:38

Target

b4463de32298aeba567e48562daec710.dll
Size

29KB
MD5

b4463de32298aeba567e48562daec710
SHA1

e298c013cede3ea72c68b332a9a139985a379de7
SHA256

c0c41aa0dfc14cc2c882f311841368559b75a38fe5ab1b6d13c5ac3a107f672c
SHA512

b2dcc23dc948bca8d484324f9c90fbf219cf4e89817a6a7937744af9dfc4daad5f211f5e9773bdbdd1f93cc4c70f2e853ebbae317bd3682f667b74733244611d
SSDEEP

384:WUnMA6iQCr+/I7KmicVzOKadirT5RJgg8HrqehZ57Gci/mO2utbh1iRw5Jp4nIu:NMTiLrX6cVOKauT5oPrtKmO29UJWJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4463de32298aeba567e48562daec710.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4463de32298aeba567e48562daec710.dll,#1
  2⤵
  PID:2904

memory/2904-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download