e12c70f93b0fbf470477f2f76bfd4a4d0dcd00df8492a457653d7504e4a70b63

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 17:07

Target

c927e707357a48e9ef7abaa7101d9ecc.dll
Size

179KB
MD5

c927e707357a48e9ef7abaa7101d9ecc
SHA1

41f2c1c2ad2732fbdde9116c0b31286992a52520
SHA256

e12c70f93b0fbf470477f2f76bfd4a4d0dcd00df8492a457653d7504e4a70b63
SHA512

383ddeeb8b08e2338fd45cd69e725527db79e5f90d3c34879e858e2147382634336c1fab2b32c4261454fbf727ebc932dca8d6a93fd88ec2c8df1f29cb8d8542
SSDEEP

3072:EPQ+CQ2bpfKg1zA/WfeOGAbrzHJlp4Yph24d2kbySiVTSBGafogriC9BDMqqDLyd:EY+CQ2bpfl1M/WfeOGAbrzHJlp4Yph2I

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28
PID 2240 wrote to memory of 1352	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c927e707357a48e9ef7abaa7101d9ecc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c927e707357a48e9ef7abaa7101d9ecc.dll,#1
  2⤵
  PID:1352

memory/1352-0-0x00000000000F0000-0x00000000000FA000-memory.dmp

Filesize
40KB

Download
memory/1352-2-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/1352-5-0x00000000000F0000-0x00000000000FA000-memory.dmp

Filesize
40KB

Download
memory/1352-6-0x00000000000F0000-0x00000000000FA000-memory.dmp

Filesize
40KB

Download