704a97bb75dbb979624b51d26486bf6e976e91b3fa6c77a12a10edd6acf524a1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 19:11

Target

b973b4fb4dd31eb2250b528dd656f612.dll
Size

288KB
MD5

b973b4fb4dd31eb2250b528dd656f612
SHA1

31a88f95e83492c230674d061409a4ddd6c33225
SHA256

704a97bb75dbb979624b51d26486bf6e976e91b3fa6c77a12a10edd6acf524a1
SHA512

80c5dd17f4b45777055d3621fd09794fab19eb0af5cd7b8e128b85d6cf75a2f35d65bf255be4b2a433dfd0c58936f0606d55bcda8758ca960235bd90e19f2e87
SSDEEP

6144:KhPGc8yLssPO+7JL/olq2LHXdK6WLxFItdo/RaUGxX:IPGcJ5PO+FLctWLxuo/RaUG5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28
PID 2256 wrote to memory of 2168	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b973b4fb4dd31eb2250b528dd656f612.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b973b4fb4dd31eb2250b528dd656f612.dll,#1
  2⤵
  PID:2168

memory/2168-0-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download