532bfdb0062749376502736766e36fa522ecb665eda4e5848beff57bb07c8783

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 13:00

Target

c5ef8b2d53d157c5a6bf17113132ad4e.dll
Size

34KB
MD5

c5ef8b2d53d157c5a6bf17113132ad4e
SHA1

69704052d1f5acd02fcf9de50a305c03baa9eda0
SHA256

532bfdb0062749376502736766e36fa522ecb665eda4e5848beff57bb07c8783
SHA512

e63dd2080b1ad822a40f9e43f88aae29c382ff8d29e96bdf6eca174a6775a962fc3ea760b28479d9703b37599d317aed17ece71060a3c73b6617650641dc6b56
SSDEEP

768:ubOhTLYMpXQ3T3YNrZr//7WvkZCOqhnPmRZ7p0jQF:2OhTPN/Nr17WvHpORZ7p0jC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28
PID 2208 wrote to memory of 1752	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ef8b2d53d157c5a6bf17113132ad4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ef8b2d53d157c5a6bf17113132ad4e.dll,#1
  2⤵
  PID:1752