263b6359055a8a55c511550c75f80dd541bb73db24665fa282f1a0d55c4917b0

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 04:13

Target

c26c18bd4ea5ca91d0ab53d54ef344fe.dll
Size

14KB
MD5

c26c18bd4ea5ca91d0ab53d54ef344fe
SHA1

4dec653f150d3abee178091b095b3c53e96afe1c
SHA256

263b6359055a8a55c511550c75f80dd541bb73db24665fa282f1a0d55c4917b0
SHA512

c9b032915ac11bf121ca608938ff2d8e56b17d5e0dbd70b64d44c29861ef298a8d0c8a60f0272ebdbe48352d6b2d9d9e9659c4be49a78be65d4ade812480f331
SSDEEP

192:YyyHqLHpuVJ4aLSzj2VvjDzb/jgqPei442WGpSOPv0nX4fP1rWQjpMXvX:YBGH0oaLNvHP/jgq1446pMofNpFMfX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28
PID 1936 wrote to memory of 1720	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c26c18bd4ea5ca91d0ab53d54ef344fe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c26c18bd4ea5ca91d0ab53d54ef344fe.dll,#1
  2⤵
  PID:1720

memory/1720-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1720-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1720-2-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download