a05275233896daca9600e996187e43d8ed1b62c075eb21cc17c00f6f254f6bdc

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 04:47

Target

c5027f13a101e258d578fa448b81429d.dll
Size

128KB
MD5

c5027f13a101e258d578fa448b81429d
SHA1

83544b30a6df2da8a4e08010c53ba0123a3d2b5b
SHA256

a05275233896daca9600e996187e43d8ed1b62c075eb21cc17c00f6f254f6bdc
SHA512

bbcccd8070728734f0fa9f662da60c0b25bf0708fa6552d79038eb92ea8afd0b30079de8d6619b722f3e95242ef8b9f935ddd68aa866be9eda056c4bdb121ed2
SSDEEP

1536:0ELv10pQG67VcSMY5LNWtH2AtpbDDfn5w+OXHTuk2ttR2WuASV:9NAQGM2WAv+TN2tn8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28
PID 1848 wrote to memory of 2036	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5027f13a101e258d578fa448b81429d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5027f13a101e258d578fa448b81429d.dll,#1
  2⤵
  PID:2036

memory/2036-0-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download
memory/2036-1-0x0000000010000000-0x0000000010085000-memory.dmp

Filesize
532KB

Download