0f9cd549a60e6803402dd5aaecfbe782e643d8ee8c58b970dec5ea6c20a65826

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 14:40

Target

b7a6617a91e3bbe3df5a17a05c9d28b8.dll
Size

60KB
MD5

b7a6617a91e3bbe3df5a17a05c9d28b8
SHA1

22cfbff0adc55c9949aab5c229f0bb6525581f10
SHA256

0f9cd549a60e6803402dd5aaecfbe782e643d8ee8c58b970dec5ea6c20a65826
SHA512

6c2d2ef70ed7b99e4c524ab7bc066ac09837dead67120a60ef5dbd19fe9cfabe811972754dbf2ae64cb007a3be90830728f745fb284333c5679269e75b282adc
SSDEEP

768:CXU1t9jf5CCN5FW4xXTUOycLPA439wP5iPgLa1zM7TS3odG8Y:SyfPXxXTTycr39foLa2QodG8Y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28
PID 2112 wrote to memory of 2240	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a6617a91e3bbe3df5a17a05c9d28b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a6617a91e3bbe3df5a17a05c9d28b8.dll,#1
  2⤵
  PID:2240