49f6cff5780295315c7dd85367ef9416a93440da3d5339d709d56a6255b2116a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 21:34

Target

c1a8d8b41de36888af83e2a7e7812ae7.dll
Size

72KB
MD5

c1a8d8b41de36888af83e2a7e7812ae7
SHA1

57c571e0916bc11a9a81095435a7ac1e6336226d
SHA256

49f6cff5780295315c7dd85367ef9416a93440da3d5339d709d56a6255b2116a
SHA512

be700c62194800e9a959b8861646a01e71f3c3b9aaa5ba571ba6250d68a221265c2b672f23b559ba8127b031ff36758c3be26719c911b09a80e53ec007245232
SSDEEP

1536:5Tb619lyg9Oqo0zIALHO++4GCr/CMenLUjlCQtECxbi8LUtmr6:JFAMgfxbr/xdtzxJUtU6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28
PID 2212 wrote to memory of 1712	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1a8d8b41de36888af83e2a7e7812ae7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1a8d8b41de36888af83e2a7e7812ae7.dll,#1
  2⤵
  PID:1712

memory/1712-0-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1712-1-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1712-2-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1712-3-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download
memory/1712-4-0x0000000010000000-0x000000001005B000-memory.dmp

Filesize
364KB

Download