3ffadb7209e13dece3a70539d16f71439e37ee040523d044e4820adc4095b2b7

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 13:17

Target

c0af043827809e55fc268b7fefd69dc6.dll
Size

22KB
MD5

c0af043827809e55fc268b7fefd69dc6
SHA1

53f6cb92c24158d202760d4fe1c4d1a0eb18c5d5
SHA256

3ffadb7209e13dece3a70539d16f71439e37ee040523d044e4820adc4095b2b7
SHA512

746d8c4c7f6150e7f7e7991579c6dcb11106524a70d6961bfeb0d36fd066514e9c7e0f7ac047da898edd8d9a3d7559a5aa7f7d9960065f8239d9616db587a9a9
SSDEEP

384:eUcF+83n5g1phfGaj4sUUYGGtYw+kgG4O9Gucw21OhcXZ1MEtt1g:a7gXhLj4wGH4EGu/jIZ1jzO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28
PID 2216 wrote to memory of 2060	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0af043827809e55fc268b7fefd69dc6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0af043827809e55fc268b7fefd69dc6.dll,#1
  2⤵
  PID:2060

memory/2060-1-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2060-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download