4af49c8cddb3b267322e89f92791b34b72ec62ac3fbc4462cf28ce9f38f21792

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:08

Target

4af49c8cddb3b267322e89f92791b34b72ec62ac3fbc4462cf28ce9f38f21792.dll
Size

6KB
MD5

e9094c26f1612bba1ba10e2668b9e0ad
SHA1

56b75be536c56a5ebcba3b7aa554fc5383856812
SHA256

4af49c8cddb3b267322e89f92791b34b72ec62ac3fbc4462cf28ce9f38f21792
SHA512

d4b6d7dd0cde0230926b32d64fa39b175ac32a5a4ff0c61b836f82d3c6a7f354015b3b2110f373c51152af16bcb27706215b61aa6351ddd72dbfede17bd9aa1c
SSDEEP

96:hy859x0P8MagpgV/e45EK8p9/dpKPn0vaciCk:F5oLRYZOlvpKPPxC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28
PID 2172 wrote to memory of 2280	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af49c8cddb3b267322e89f92791b34b72ec62ac3fbc4462cf28ce9f38f21792.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af49c8cddb3b267322e89f92791b34b72ec62ac3fbc4462cf28ce9f38f21792.dll,#1
  2⤵
  PID:2280