ad41073c135a05b0a6a425f881223d0a4885520f254c7d58ba10d889be43de18

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 01:46

Target

c75fa4e0b61cdf8aed91a29e3e4cfed0.dll
Size

268KB
MD5

c75fa4e0b61cdf8aed91a29e3e4cfed0
SHA1

070701e217c392fe27df72f3f25e85dcb200b152
SHA256

ad41073c135a05b0a6a425f881223d0a4885520f254c7d58ba10d889be43de18
SHA512

43944e423a70bdd2e78df0a8d783830fabb3cdf539ee4bd6a1aea1cc062f1cc10b38536383e2eb475a114038983572a1eb2e07cdc3ede9b892b5981c0cebcce0
SSDEEP

3072:HC5mwjd/X1MU0Zovs9x/EFdGVUJG2DPpKjJ8AXp0da/65SGsoMQWaMAyaPiNTZV:HC9j1FN0CC16I27S/6TW3F3Nt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28
PID 1772 wrote to memory of 1736	1772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c75fa4e0b61cdf8aed91a29e3e4cfed0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c75fa4e0b61cdf8aed91a29e3e4cfed0.dll,#1
  2⤵
  PID:1736