0f93c56977c9ce51ca91c239114b808ad475d5b06ba16602c10b71c465ffa5cb

Analysis

max time kernel
0s
max time network
5s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 05:51

Target

c5230d8e6d869986b31fe736d40c9353.dll
Size

307KB
MD5

c5230d8e6d869986b31fe736d40c9353
SHA1

c27be47d607f3573ea162706beb06396bff4a718
SHA256

0f93c56977c9ce51ca91c239114b808ad475d5b06ba16602c10b71c465ffa5cb
SHA512

cdd48a7fa944cb0020095187f77d12c2f2c6c93c2e6839c335a90ad5903261050dfd605cfe86554a588e9f0fadf366e65267076f1fca911ea3436cd3f6293f6e
SSDEEP

6144:RipXHsVHbxU3c/peHnoFwxHkocegHVSXHgeyyC4/ss4C:R+4bKKpeHoucegjeyfU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28
PID 2876 wrote to memory of 2932	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5230d8e6d869986b31fe736d40c9353.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5230d8e6d869986b31fe736d40c9353.dll,#1
  2⤵
  PID:2932

memory/2932-0-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/2932-1-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download