a6548331abe370edb816991aa2c004ea1871ce65730dc44a77cf5a364e580c74

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:11

Target

b939a783f8f748d97241eb9871fd3e2b.dll
Size

25KB
MD5

b939a783f8f748d97241eb9871fd3e2b
SHA1

2362aaccf02185440e4abf18365bfb7b3be94107
SHA256

a6548331abe370edb816991aa2c004ea1871ce65730dc44a77cf5a364e580c74
SHA512

fcfed2461668babc492634b2f7d8452d714adde930910100ee122464807aa69a4842a566a119a53ccf7967f591293f9bfb9fcedabdcab39cb395206752c579a1
SSDEEP

384:Hn8nWO/uznnLH59TtqMufgnHOZNZbG2FIKQ2fNaBNqhqoetZynSnnnniiq2nUtnf:28n4MnuZNVG2RnSNqhE5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28
PID 2204 wrote to memory of 1944	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b939a783f8f748d97241eb9871fd3e2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b939a783f8f748d97241eb9871fd3e2b.dll,#1
  2⤵
  PID:1944

memory/1944-0-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/1944-1-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/1944-2-0x0000000000190000-0x000000000019C000-memory.dmp

Filesize
48KB

Download
memory/1944-3-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/1944-4-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download