6f048a2e0357817bbb198cae532d2f96b99ba25d516868bab094be45fa64c9a6

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 00:40

Target

b612bce5a8a8c49523c5b7c1c5362c19.dll
Size

205KB
MD5

b612bce5a8a8c49523c5b7c1c5362c19
SHA1

46ca4fc751ca932135a6c2045212322c91f14997
SHA256

6f048a2e0357817bbb198cae532d2f96b99ba25d516868bab094be45fa64c9a6
SHA512

70598a52ca90bc8202413478fbb9fd1bcda8c980e5f1fa98cb2aec0207804dd1d11f47262c46e34ee1abeed9589b2db646ebfdbfd25431ade7aa1f792953dcb5
SSDEEP

3072:twLvY6vUax8bweSS3MInP3CeXKhqwJ+N/EJoSun5K909XB47ZBD66wsv2uD:G/MaabwebMcyeXKhqeJoDYy47rNv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28
PID 2228 wrote to memory of 2264	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b612bce5a8a8c49523c5b7c1c5362c19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b612bce5a8a8c49523c5b7c1c5362c19.dll,#1
  2⤵
  PID:2264

memory/2264-1-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2264-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download
memory/2264-2-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download