a06bbc3562adee14b2a01bbbe7f04834afcffa5bfa75ba134f0a912b695aef14

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 07:54

Target

c2d929b55c76ffb3042a0876d6b45d16.dll
Size

88KB
MD5

c2d929b55c76ffb3042a0876d6b45d16
SHA1

2cc6e2786132b98b79007eaeb73521cb010d9589
SHA256

a06bbc3562adee14b2a01bbbe7f04834afcffa5bfa75ba134f0a912b695aef14
SHA512

c0c25e00e0c961815c03466a4162e510783efdecf992118a3897dda904eaceec5f04675dc90d094f6cd167fcc046e4287c8b88fed946f279b6b596e103d81e3b
SSDEEP

1536:SAVJ0mWeB/iU9xrYOHeygBcwJUktiZTPlnDN4XIs1u31kTpMXr1h:zJ0mW8/iOr5+3JU6QTlnDNqLc3t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28
PID 2412 wrote to memory of 2124	2412	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2d929b55c76ffb3042a0876d6b45d16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2d929b55c76ffb3042a0876d6b45d16.dll,#1
  2⤵
  PID:2124