7b1f4204fa53954656b079149dc68890468669c4b31e1b1c65d5e8a3939f8f4c

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 20:25

Target

7b1f4204fa53954656b079149dc68890468669c4b31e1b1c65d5e8a3939f8f4c.dll
Size

146KB
MD5

821acc9163c00acab1ba36b19a93accd
SHA1

be14fb888268a40a5c5de1f260357a59b0c41b32
SHA256

7b1f4204fa53954656b079149dc68890468669c4b31e1b1c65d5e8a3939f8f4c
SHA512

a8dc1659ce2ae4f08657675146a2ed02c079b8b71a2bb8cce53e75fa97559b926c84c6b6d5ae9c51fdc39292182c1a9e8c30e1fec9393a2c86a6dff33c909569
SSDEEP

1536:k7LLMFWnw9eVfPbyFQCxz9vjseJWvVyEn3tx68sWACoRZdxLf:CLLMFJ2zyBzEn3K8sdb1f

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27
PID 2796 wrote to memory of 2428	2796	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b1f4204fa53954656b079149dc68890468669c4b31e1b1c65d5e8a3939f8f4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b1f4204fa53954656b079149dc68890468669c4b31e1b1c65d5e8a3939f8f4c.dll,#1
  2⤵
  PID:2428

memory/2428-0-0x0000000000340000-0x0000000000380000-memory.dmp

Filesize
256KB

Download
memory/2428-1-0x0000000000380000-0x00000000003AC000-memory.dmp

Filesize
176KB

Download
memory/2428-2-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2428-3-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download