7d23b93c64d8f36037f66474908ffd617bd6b2db963a81e73eccbd2baf5ca3c7

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 13:19

Target

bb5cfd2b5c015fc6dbfd4cc02cadc5bd.dll
Size

96KB
MD5

bb5cfd2b5c015fc6dbfd4cc02cadc5bd
SHA1

531838d4fc6a0213b6f01427648fd0f94a72d86e
SHA256

7d23b93c64d8f36037f66474908ffd617bd6b2db963a81e73eccbd2baf5ca3c7
SHA512

4b03bc04c814627bf0ab864b962ee22411bbcc54af7a9cdf1382f831a41f0eb07935f165b882a69e5325504117b3ce2a9752a6ea239e713c0081fee3be864203
SSDEEP

1536:BY6BaNdgcZX8/FdrJKtAbicmx6qKAoHYt1WpwpSX5ZbDJpTu6/:OfXi/JKOQx6zpU1Goa5ZT/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28
PID 2812 wrote to memory of 2036	2812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5cfd2b5c015fc6dbfd4cc02cadc5bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb5cfd2b5c015fc6dbfd4cc02cadc5bd.dll,#1
  2⤵
  PID:2036

memory/2036-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/2036-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download