f84c303b1c8fd723a53f62117cd515199a7605558d082319ec29b71269fcc0f0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 18:29

Target

b960e2a97102e7f3c37f75fa794b2add.dll
Size

4KB
MD5

b960e2a97102e7f3c37f75fa794b2add
SHA1

d13f7980901d9db72a24249e9c862c389fa5c071
SHA256

f84c303b1c8fd723a53f62117cd515199a7605558d082319ec29b71269fcc0f0
SHA512

05f6ed95684f92e01d33c03e30be6f28e20385c7270795b75e13e683af560b8619f1f8bb40af36e304bb9f3645d91f35f03bdfa6a49cbda47a46f86e3437d353
SSDEEP

48:a5z4K+cmATmRYoRZCTJzJmQPrhBpX9Q2GoWLht+/fPdbX1LmyJ2Muz:MTWnRZ0lJLPFbX9QcWVtQdbX1LlJVuz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28
PID 2904 wrote to memory of 2100	2904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b960e2a97102e7f3c37f75fa794b2add.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b960e2a97102e7f3c37f75fa794b2add.dll,#1
  2⤵
  PID:2100