c4b481e427d46283c147de3816a1b5df6e9b1d7d586a38c01e9e365a9ff58072

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 13:47

Target

bec22168a2ad5c9ed0e83476fc6ef59a.dll
Size

126KB
MD5

bec22168a2ad5c9ed0e83476fc6ef59a
SHA1

7905a70392af0fd9d73e42f592367cd42f52839a
SHA256

c4b481e427d46283c147de3816a1b5df6e9b1d7d586a38c01e9e365a9ff58072
SHA512

c05c3d45c76048a8dd1729f89d5ca59c2e6c3cfbb0223da4caa919eb306593bb45097d2bf01379d249d6e7f7c22d285c1966a192eaf04d2b1c8944f9942b0e2d
SSDEEP

3072:K6T+1r43p/oyukeTcxG1rAYjkPD5RcdqqGPkUjCu0ClxW9:QaApTcxsUedqkUjCk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bec22168a2ad5c9ed0e83476fc6ef59a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bec22168a2ad5c9ed0e83476fc6ef59a.dll,#1
  2⤵
  PID:2400

memory/2400-0-0x0000000000130000-0x0000000000155000-memory.dmp

Filesize
148KB

Download