9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:44

Target

9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326.dll
Size

6KB
MD5

e52adc30e25efe86b2c8806530bbd8ba
SHA1

af9d82645ec832d6a3a8d378a9cae04f9bde452f
SHA256

9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326
SHA512

e7af7822fc047f73fd7db88f10588c0ddf2e80a20c6da1dc252f481a723cf93041513ea14972d0770a117041a32cdd49abb06abb92d88196dd21e5b45a2ba836
SSDEEP

192:unSR6bgYijeLOJO7OaOp6h+kvWLO28ZcCK:uZ2eLqerfhw2ZcC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28
PID 1732 wrote to memory of 2876	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a33666ae148a40cc5d1a93bbc5fc4badb2140f3466be7f82dda57173a986326.dll,#1
  2⤵
  PID:2876