d3a3fd970a93427d22718cf90785fd02e337017d88084190d03f3df508aedf41

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 17:55

Target

c13b7d742fa6cc645fa00f4b7a4483f8.dll
Size

135KB
MD5

c13b7d742fa6cc645fa00f4b7a4483f8
SHA1

dc59d76a56661a6c175116b2f37fd52bc33d4a11
SHA256

d3a3fd970a93427d22718cf90785fd02e337017d88084190d03f3df508aedf41
SHA512

4fcd4f3a85d11e79a52a90b512428d318ed6c6532b9096c8e437a562e220d3fd41f7d0ed90c61c61a23a5279da1946e36b734ff09cfb793061d3cd369af79b94
SSDEEP

1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMlj:nu79WdaC2urufq33UeYuOu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c13b7d742fa6cc645fa00f4b7a4483f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c13b7d742fa6cc645fa00f4b7a4483f8.dll,#1
  2⤵
  PID:1940