a10cd7016d5d36385767317a6e7d4e1d871c58110289e98e254cf72ab7e1e0c9

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 06:29

Target

c533639f30c489b1257d4fc3c11181d7.dll
Size

7KB
MD5

c533639f30c489b1257d4fc3c11181d7
SHA1

775c0bc618723694762f6f09c81e663d56867f96
SHA256

a10cd7016d5d36385767317a6e7d4e1d871c58110289e98e254cf72ab7e1e0c9
SHA512

e77741efe48dd2c0d32356e3a49f40a1e451f0bf601bed9281240ff187242a4cc6dd608be459688b9a1ed715b2ec6aa537bc4dcb75e39f9cdf8ff951963cac7d
SSDEEP

96:nPsX/Fk0rQeb6zhn6T2/cxou8b2R+8v+og/lfU8dTMP345QT3BL5aQt:n0X9k0c19UouCtCglfhdT84+tI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28
PID 2756 wrote to memory of 2076	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c533639f30c489b1257d4fc3c11181d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c533639f30c489b1257d4fc3c11181d7.dll,#1
  2⤵
  PID:2076

memory/2076-0-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2076-1-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2076-2-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/2076-3-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download