379740f127546f34863cf1f03c6008a7809ae88e44d2bc1efce56ddeabc42dba

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 18:45

Target

379740f127546f34863cf1f03c6008a7809ae88e44d2bc1efce56ddeabc42dba.dll
Size

342KB
MD5

d06f4c518f65e6c004fb6d1554fa3c31
SHA1

8159853d8379a95244178da897168a3105049e6f
SHA256

379740f127546f34863cf1f03c6008a7809ae88e44d2bc1efce56ddeabc42dba
SHA512

479eb3c84a06be726fb868660434e4ea882b553dd33aa05e2abe77c365fe3666956637e7277407c4267aef65c933887905184751ad7c82628ee6d045b762ac97
SSDEEP

6144:YRoOpXN8bEvZehNyi5qlscXsKCkSLjn7WQDilmvWpJJvEiS:YRoOpXCjNwlscXeJikilmvYEiS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28
PID 2676 wrote to memory of 2964	2676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\379740f127546f34863cf1f03c6008a7809ae88e44d2bc1efce56ddeabc42dba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\379740f127546f34863cf1f03c6008a7809ae88e44d2bc1efce56ddeabc42dba.dll,#1
  2⤵
  PID:2964