a9b18fb9673a75feb05e3037fbc0a88a19be3b9b498375217d9323562291e408

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 23:25

Target

c71cdc41e5899a13677300ce2259bb9b.dll
Size

37KB
MD5

c71cdc41e5899a13677300ce2259bb9b
SHA1

8635a6edf4381a020aa9cf0587be856facf72d00
SHA256

a9b18fb9673a75feb05e3037fbc0a88a19be3b9b498375217d9323562291e408
SHA512

3a8b0f234c368f2cc3bcadb625cd2d3cd82b8587bf232510e8e75e484c3050184d9a7978bbd3131aa5185b53083ca03a8b0d303f4dce11150463dcba9841d38f
SSDEEP

768:sBR033t4tIWfIqzf0SC1N3v7fq3v+tqWMllxd8I333k333ShToP3U3hx:s0xxC0P1N3v7fq32tClHd8I333k333S9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c71cdc41e5899a13677300ce2259bb9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c71cdc41e5899a13677300ce2259bb9b.dll,#1
  2⤵
  PID:2088

memory/2088-0-0x00000000000A0000-0x00000000000AF000-memory.dmp

Filesize
60KB

Download
memory/2088-1-0x00000000000A0000-0x00000000000AF000-memory.dmp

Filesize
60KB

Download
memory/2088-2-0x0000000000160000-0x000000000016F000-memory.dmp

Filesize
60KB

Download
memory/2088-3-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download