41f9508c8781160199aa1cacd8278be6ee6bc79356b9a057e0a553348b04fbfc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 08:52

Target

be2ed2a4e4583d90664e2fe5035efea8.dll
Size

73KB
MD5

be2ed2a4e4583d90664e2fe5035efea8
SHA1

c9b486e8a08b78e668b357a342ab7fc14df532a4
SHA256

41f9508c8781160199aa1cacd8278be6ee6bc79356b9a057e0a553348b04fbfc
SHA512

9d5aa1d45c2e7bfdc3cdf887a0b950e69cb9a9ec2e7c73bc4483ba721670556a8fd44583c0f142cb48d0baf01e463142303a5d713394a5f04135a6ceb1344330
SSDEEP

1536:AeE/Pb7tV7h3zXyW4jMXwfPmJi/KHCxE47myxBpI3/pe+xwfero+77:AeEL7tV1OMX/tOE88/pwfmD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28
PID 2900 wrote to memory of 2292	2900	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2ed2a4e4583d90664e2fe5035efea8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2ed2a4e4583d90664e2fe5035efea8.dll,#1
  2⤵
  PID:2292

memory/2292-0-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2292-1-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/2292-2-0x0000000000160000-0x0000000000172000-memory.dmp

Filesize
72KB

Download
memory/2292-3-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/2292-4-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download