53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 22:00

Target

00050760.dll
Size

567KB
MD5

0774c02ebf15c53ff5de382f5e7a36d4
SHA1

d5898fff340b9038b39cbc5615569cfbacffc562
SHA256

dd557e37601687d419989b3e6cd2926e4b74aaa51b96aac715a68dc57eef005b
SHA512

9ef96f83a10f748044904814ca3c16153fc883e0a71268d332617c0eba435825dfe1d09f0d0ef3359a5db0d7d8b2f3c0d8d05b9342a35f5ae038e6bc075b4f56
SSDEEP

3072:LrVX2uNdTKhpm5/ruPlLzF+SZklm96JYKY648dsLDSEQs1sLtGNBnVn59FvDjrIj:hNlKhYzuPlvQSZklm96JYKYBIajFfGj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00050760.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00050760.dll,#1
2⤵
PID:1736