55e85b8c25c73761ace8b69ed6715969a141d479dfa19ff626bb25ebe6946f31

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:11

Target

b9396981fd2920dcd8c7a23365c12788.dll
Size

304KB
MD5

b9396981fd2920dcd8c7a23365c12788
SHA1

dd1330a3c5b3109767ee5efd23c307ad8779242b
SHA256

55e85b8c25c73761ace8b69ed6715969a141d479dfa19ff626bb25ebe6946f31
SHA512

6f4185c8d79e25b4ecb8addb7bcfbfeb15d7d76343ae7f5cf8e1fdfb6fd8b75e4e998bfb98315c0d51c72e47ad6653feca0fc86eabb0bd406c82e433c0fc1328
SSDEEP

3072:EtR5WjfnFWIPJYWIWg2OjMLwHOiOoRaLJZWjVlrNyAsbigehzlXvrt7QCwp:XWOKFhYwuFWvrNyAsmlfVq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28
PID 2924 wrote to memory of 2928	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9396981fd2920dcd8c7a23365c12788.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9396981fd2920dcd8c7a23365c12788.dll,#1
  2⤵
  PID:2928