0a48707a4f884b555b9884bde2b3cc22799e3a9857ca5f47b8c274127827cfc9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 07:04

Target

bad1e893ccdf5a07a2875d0ffd1b0224.dll
Size

312KB
MD5

bad1e893ccdf5a07a2875d0ffd1b0224
SHA1

7227c14049c3372fcf198218223f899a8be17110
SHA256

0a48707a4f884b555b9884bde2b3cc22799e3a9857ca5f47b8c274127827cfc9
SHA512

50c0c16711f37213712085c5eb02d1f75e3a5703ef06bdbe07c6fe919f4d9a681598e05941d8c9f1d1b671a519bf0ed923614d18c43a4d6650d5d47b5f0b8a98
SSDEEP

6144:IQ85KIQ/KLLmQEK3Rzg1L6355ctud7MOpfBgHR1:IQ85KIQ/KLLmQEK3Rzg1L6355ctud75c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bad1e893ccdf5a07a2875d0ffd1b0224.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bad1e893ccdf5a07a2875d0ffd1b0224.dll,#1
  2⤵
  PID:2916