fe5a404ccac89b80040bdb5ebbf64c04385222b79758cd9d0a117dad562ad208

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 08:08

Target

b6effe45324cc96f0269a6dd823f5941.dll
Size

81KB
MD5

b6effe45324cc96f0269a6dd823f5941
SHA1

77af9f1fb006c9a0884457f6ca891062e8cda85b
SHA256

fe5a404ccac89b80040bdb5ebbf64c04385222b79758cd9d0a117dad562ad208
SHA512

1eb6814af024fc860af87f38b0a2ab2beb491e86cb81bd1a9a01e34738ac9f8cb042499b7508766a2338edc92b143cf21a7e8b4fb9f9a0a6bb8cc603f3f1dbb5
SSDEEP

768:9iwxqsQo0yFQu0W+0oacWJSbQIchmzXN7c1S8N3GO/0H6TbzkXw8RWAVtpVk60/3:MwxqsQNu9ZSkNgXNse6T3kXweVt8/1x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28
PID 1504 wrote to memory of 1736	1504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6effe45324cc96f0269a6dd823f5941.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6effe45324cc96f0269a6dd823f5941.dll,#1
  2⤵
  PID:1736