ceffb5851a2531d2ee8de49853b3e67361629f45a87c241ae3cf27d5004b79e0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 19:51

Target

b587a94aa151a8c50f1fde4c42e984a7.dll
Size

40KB
MD5

b587a94aa151a8c50f1fde4c42e984a7
SHA1

4e359bd3f617a09f348a6b0b1018cfed8c65ff42
SHA256

ceffb5851a2531d2ee8de49853b3e67361629f45a87c241ae3cf27d5004b79e0
SHA512

2be4bf26e2b2a9acc603c68c8ddb2f74094bdc2edc74a647a68a6f84270b61e71b066c91a0bb6962dbc38996f81948fea7b738a5dce746dbd7e07ea7199437ec
SSDEEP

768:axxdIJ4mbDbIzmMeM5aaPzSZ3eSuovsK8Lwc12N8AVKX1zpo:axxdI/vEmMt5aardSuokK88WBFzpo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b587a94aa151a8c50f1fde4c42e984a7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b587a94aa151a8c50f1fde4c42e984a7.dll,#1
  2⤵
  PID:2056