3d1450f7346183bdab6bc06d8f3a66399f4df8fbb376a694def55e5b3ac4dcc9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 06:48

Target

b6c672ae71262db07c2ee00def1e51ea.dll
Size

224KB
MD5

b6c672ae71262db07c2ee00def1e51ea
SHA1

11ba3f925b9f85d01ba315f664925b7ac8fe2d0a
SHA256

3d1450f7346183bdab6bc06d8f3a66399f4df8fbb376a694def55e5b3ac4dcc9
SHA512

f3a1c219e47ffc56ed5397d66746d46bf378f7c93d0754859bb57030c888452a1cc06a72072cb365d80af73e38e47788d4b69c789f7e2f2b090743490022ca70
SSDEEP

3072:8Dr1vM8ZiUD8r01PwskxcUOOjXnb/BjNvc3X+N1Fn5lw3G1Of:g+8ZV7g5/BB7Tn4o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28
PID 2512 wrote to memory of 2736	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6c672ae71262db07c2ee00def1e51ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6c672ae71262db07c2ee00def1e51ea.dll,#1
  2⤵
  PID:2736