bc1fee63f58691d2154ea024fe5bc4bd6dccedd986a0e3ac7a29161d0ba3d076

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 16:18

Target

c108be569bb47f4663716cd2d517929c.dll
Size

90KB
MD5

c108be569bb47f4663716cd2d517929c
SHA1

43e838039e112701bc30ca3ffe278ece9f89b24e
SHA256

bc1fee63f58691d2154ea024fe5bc4bd6dccedd986a0e3ac7a29161d0ba3d076
SHA512

3cf32b2da587a38f81bdaf8c56f38810bd9458537fe0fa8bcd583afa13578c8c1d27fc7cb4fd705dcd07e3aa57f7f946fd4bdc709050d9b67e198ed5d8e3dd71
SSDEEP

1536:WhVbLtdV5KC14wko4GdCDaEQqBUQ41hDbxOvvBb8opVw:WhVbJ14KDdCD6GUjxmvBAn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28
PID 1512 wrote to memory of 2336	1512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c108be569bb47f4663716cd2d517929c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c108be569bb47f4663716cd2d517929c.dll,#1
  2⤵
  PID:2336

memory/2336-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download