4018a1b6d2544d9f68f16339f08b0206bb2d7703a63aac935ea6cd1c3a507a40

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 23:43

Target

c1e8a872b2f7f293c10c0d9fa860d33e.dll
Size

28KB
MD5

c1e8a872b2f7f293c10c0d9fa860d33e
SHA1

454dd38baf04bf551a0749b92f27b26776c07543
SHA256

4018a1b6d2544d9f68f16339f08b0206bb2d7703a63aac935ea6cd1c3a507a40
SHA512

5fad4c2b0c5aa88cc085e79aba1771fbe6381bf661fd5f36f34766e33699481d5f1e4e862fd37108ae3a876e6a0623fd3c226f09295df1b228f27daf0903ab8e
SSDEEP

384:fCEvvCnwcS60olydY4PEkZyYGZa2ArLhnXMspct5mAjcDmCO:pvCnw760JPckZyLZlAPhnXZat5mLDTO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28
PID 1152 wrote to memory of 1772	1152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1e8a872b2f7f293c10c0d9fa860d33e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1e8a872b2f7f293c10c0d9fa860d33e.dll,#1
  2⤵
  PID:1772