e1c9f625d1e90cf571d1991c7ce475de9fbf18b39ad2c2722f7e9a494232a5ce

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 11:35

Target

b74c62735416aafb8a5391ff907b3991.dll
Size

36KB
MD5

b74c62735416aafb8a5391ff907b3991
SHA1

b4cc2cc20bc58dbc899ff20fe011ba1b9527c131
SHA256

e1c9f625d1e90cf571d1991c7ce475de9fbf18b39ad2c2722f7e9a494232a5ce
SHA512

c8103cc0641535017ac4548e0f25374d5e4ce3a62494fe9fc4bf9c03d01ee41b8022c94be57e3cb36760e92a90efc29119a75c9a7e8f3b7ed53746ffc9e41d8a
SSDEEP

384:DiCdSo5CjLJdNGoYsGGtg6H2yAf7Mxm6t8eNu1q7/PsULF/7W757W:DNZ5CnJPGl6gA2yU7MxT8Sj0cte5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28
PID 1292 wrote to memory of 2464	1292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b74c62735416aafb8a5391ff907b3991.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b74c62735416aafb8a5391ff907b3991.dll,#1
  2⤵
  PID:2464