ac9e9d23ed5e0470baa75d4044b1200179cb21f609c3ac3a7d2769c2f9f36e2c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 16:59

Target

b934dd7be285b0bcee496d8ebebfb075.dll
Size

130KB
MD5

b934dd7be285b0bcee496d8ebebfb075
SHA1

d5148c8e0383221114e42e0b269ec0fab9d2bd97
SHA256

ac9e9d23ed5e0470baa75d4044b1200179cb21f609c3ac3a7d2769c2f9f36e2c
SHA512

1231d2f5cc0077e02de0039348c1549f4aae3d046e6b9c1a4c7843fa51195c3211ebe69cfc81b74fd127f8c9c8bea128f1197923cabd5614c44eb497876eb6d8
SSDEEP

1536:6Rw9k6k1FrHc5mlywhJNu85JZFX/sU8JHBQO2b/oChuzpl:/cHr8IywhrpX3Ahmb/op

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28
PID 2876 wrote to memory of 2256	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b934dd7be285b0bcee496d8ebebfb075.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b934dd7be285b0bcee496d8ebebfb075.dll,#1
  2⤵
  PID:2256