24c5fe340a5f139128208636c9a4fb1df5f03b66b49bea5121bd4cdf0854a86f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 23:01

Target

b9e2c0c932e165a76905c455dd029e1d.dll
Size

612KB
MD5

b9e2c0c932e165a76905c455dd029e1d
SHA1

c17a8f185a9133bfaa02b516b3576059e75a0d8c
SHA256

24c5fe340a5f139128208636c9a4fb1df5f03b66b49bea5121bd4cdf0854a86f
SHA512

38f9f09430156fd46b7e8cdd29f3b8747c61331c4afa39c5d012ec86ddfaa4e4d4e4edc6dd79d3c433c284dae55fb8fd8d76ae72e9733662d40e39ea0274fd8b
SSDEEP

6144:ccrxoRytfUaFty+yr+T3jY74d3CJ/JTmYn0YaAsGIUX8ROvs9E2SzSeiqMMPI1qN:WwfUaFty+yr+Ts4d3kmYn0YaAsGGBM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28
PID 1636 wrote to memory of 2220	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e2c0c932e165a76905c455dd029e1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e2c0c932e165a76905c455dd029e1d.dll,#1
  2⤵
  PID:2220