c64ba5a8489d91f742112818517b1ffbd1b9f8ef8766d11e28616360d82d81fc

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 00:57

Target

c64ba5a8489d91f742112818517b1ffbd1b9f8ef8766d11e28616360d82d81fc.dll
Size

2.8MB
MD5

09bac5a9c1882c15d2e119207bc076f4
SHA1

9cf56c8c9a0567961a492f5d81dc42b062a7af2a
SHA256

c64ba5a8489d91f742112818517b1ffbd1b9f8ef8766d11e28616360d82d81fc
SHA512

440b5f63ed34080bbd7dcf237ded25d8b6f28c545b3364171b93576593cbda901078dff8c5f9763ba464c493af2d1a8e62d1b1bf0fd182c09727fa2fdcea658c
SSDEEP

49152:4vQdg4YzH/VwgWpAz2fONvqIszTbij49k8tc:6BjN0znij49f

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28
PID 2832 wrote to memory of 1804	2832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c64ba5a8489d91f742112818517b1ffbd1b9f8ef8766d11e28616360d82d81fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c64ba5a8489d91f742112818517b1ffbd1b9f8ef8766d11e28616360d82d81fc.dll,#1
  2⤵
  PID:1804