11b05ae9ce7b55c15b8fa4149d4a3f630bbb2480653f80b337b500e4384342ec

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 21:47

Target

Wundws_Spebilgty.dll
Size

261KB
MD5

ecef401ef32e05f5c173d7bfe60ff571
SHA1

53df06de6d90408c8c584c2f40a7f49af4bbee5f
SHA256

11b05ae9ce7b55c15b8fa4149d4a3f630bbb2480653f80b337b500e4384342ec
SHA512

55d9799e6c221c9354b31c9796799b1f84e5cbc6616f2a94e764dc8347bc598254d9d90b6322396da537530238993a205499a252f3715fc664320286b12ebfdf
SSDEEP

6144:t0/+ljSOFoGp2Wd66JhjsjPVz269DGJGTljq+QAChSOB2JrQJPV:Am0rQh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28
PID 2404 wrote to memory of 2040	2404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wundws_Spebilgty.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wundws_Spebilgty.dll,#1
  2⤵
  PID:2040

memory/2040-0-0x00000000006F0000-0x0000000000730000-memory.dmp

Filesize
256KB

Download
memory/2040-1-0x0000000002190000-0x00000000021DA000-memory.dmp

Filesize
296KB

Download
memory/2040-2-0x00000000747B0000-0x00000000747FA000-memory.dmp

Filesize
296KB

Download
memory/2040-3-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2040-4-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download