37eedd6191aa0f47956280f6191b233a0c4f0eeca99f3ff9c27555b7a7791670

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 04:52

Target

bdb5609983b4f6c7690e8fd1f6035d2b.dll
Size

52KB
MD5

bdb5609983b4f6c7690e8fd1f6035d2b
SHA1

cf5ced8193bea9b1b05c2b56a716a4aafb09d0da
SHA256

37eedd6191aa0f47956280f6191b233a0c4f0eeca99f3ff9c27555b7a7791670
SHA512

8433059d3e403f76f75caa9cd74cb43148d1e4d43c27bfd09b99d537cf7fb51770095c097ffd6304cec126f9df7497ade07ba3cb2dc4f5ad92f28c16ed10276f
SSDEEP

1536:c6q/Lbwt0IbzaQLmnVfsJHMxJPWee6D9fx:2zbLIbznmnVq8Jeefx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdb5609983b4f6c7690e8fd1f6035d2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdb5609983b4f6c7690e8fd1f6035d2b.dll,#1
  2⤵
  PID:2820

memory/2820-0-0x0000000000110000-0x000000000011B000-memory.dmp

Filesize
44KB

Download
memory/2820-1-0x0000000000110000-0x000000000011B000-memory.dmp

Filesize
44KB

Download
memory/2820-2-0x0000000000110000-0x000000000011B000-memory.dmp

Filesize
44KB

Download
memory/2820-3-0x0000000000120000-0x000000000012B000-memory.dmp

Filesize
44KB

Download
memory/2820-4-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/2820-5-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download