c279d66e844cd1f7a59d082ee185f46f0bc4da82848b4388f08beeaa9bce7720

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 23:21

Target

b9eb59f94880c5eb5987430c950ac6f6.dll
Size

98KB
MD5

b9eb59f94880c5eb5987430c950ac6f6
SHA1

5230ac57cc4e0639832f41172920f3d30616738a
SHA256

c279d66e844cd1f7a59d082ee185f46f0bc4da82848b4388f08beeaa9bce7720
SHA512

770cdfa88d40d8dcc6c3d2e8b5f306a1f12654cf20794c821d8d03351b25e1b050b2220fedb7beddb844b79814ca9507d2dd36ffd85484beb52bdaa50658f243
SSDEEP

1536:FJ0cjtqTghdJEHlnRKg2cxhPfiJ8xmA/ImukHs3Z3P4ALX:xjtwCPSRKg2ih3iJ8MA/Imuk4Z3HX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28
PID 1268 wrote to memory of 2804	1268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9eb59f94880c5eb5987430c950ac6f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9eb59f94880c5eb5987430c950ac6f6.dll,#1
  2⤵
  PID:2804