3ca0b655b89107f9121be413e73124180eb8a99de8c9f7d3d1dcf32f65a13659

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 12:03

Target

c891e256fdd2eee36b4795e6b460369f.dll
Size

282KB
MD5

c891e256fdd2eee36b4795e6b460369f
SHA1

587e6e0f625a267440f9ef9886093a5f6e907b8b
SHA256

3ca0b655b89107f9121be413e73124180eb8a99de8c9f7d3d1dcf32f65a13659
SHA512

bb6b22ee0743817ce28a44a72f6cb4d8fc3eae138b90c81eb1c9151ae1eacdd7b55bc26d7f0796861bd1912c244038ece51f48613f778c79610e0fbcf5cfdf63
SSDEEP

6144:U/6Mt4oi1BqLORSUUwRZ60hM6Oaj2P4ugoSHr2MDvJ/KoSU:1Mt4rBqLgdvR00hM+j25goSHyiKoSU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28
PID 2248 wrote to memory of 1320	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c891e256fdd2eee36b4795e6b460369f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c891e256fdd2eee36b4795e6b460369f.dll,#1
  2⤵
  PID:1320