9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 23:18

Target

9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8.dll
Size

9.9MB
MD5

27ba9757b2f5cb9225ed04170da56248
SHA1

401c6d4b75ebcd30b183ffab99cb0e3b2a739359
SHA256

9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8
SHA512

10507b87a6267b9e6a97b863fcb231942e3d0a8cbb8308f36bb917cde669abc760bb3ddb1ae0e4475c16cc7274e6163181b9eb637661cffb94c3421fc775884e
SSDEEP

98304:hrtnSYcv3qPJwFwUJ4nd6B3tcPXyZStcayro/BW7YBwcTp:/nSY3JwFwE48y2a

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28
PID 2320 wrote to memory of 2368	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8.dll,#1
  2⤵
  PID:2368