d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 01:43

Target

d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a.dll
Size

6KB
MD5

e564f814d2ea29d048e173ff4b3e5697
SHA1

c0485cabb852b483c2d3a2c101d45c6a356f84cc
SHA256

d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a
SHA512

550fbd9c2f3598e7c5cdfdf8fc25ebcfe66538f58f132faadb9465ece63805fb7894d02573a118c5cb5ecbc86d987d3a0d49d68f95caeed6aba82a0d7194fc92
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0FB+BDq9J5SH:VDa9VUX9bQWlB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28
PID 2968 wrote to memory of 2996	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9812a836b27dbd1417cf17759550c93b7f22212e7beb7c88adc9a558242bb0a.dll,#1
  2⤵
  PID:2996