33c9d4401febae7578b3e82e7c4948fe940407ad5a4e9f57f65a4c500104e4a4

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 19:29

Target

c96e457ccbe4772293a915b62ab540c4.dll
Size

36KB
MD5

c96e457ccbe4772293a915b62ab540c4
SHA1

7721759a080e01bf5c6c0bcc6aab2c86fdaca9c8
SHA256

33c9d4401febae7578b3e82e7c4948fe940407ad5a4e9f57f65a4c500104e4a4
SHA512

b7bfbd3779b4bcdac434c87dee5ee21956c69ed0d3641f6e0c7423e2319ccb17fa7bc2efd457835ee3360353e3e438e6fe4d88bf6954dee789b2616522b994d7
SSDEEP

384:UY1IXT8ZKsjLct/5CZxDWtAdK//Z4SnqIqq3Ev7uBBQARQklIaAVFAjEP:UY1IXq79hg+RXkI6BBQARQk/AVFB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2712	392	rundll32.exe	28
PID 392 wrote to memory of 2712	392	rundll32.exe	28
PID 392 wrote to memory of 2712	392	rundll32.exe	28
PID 392 wrote to memory of 2712	392	rundll32.exe	28
PID 392 wrote to memory of 2712	392	rundll32.exe	28
PID 392 wrote to memory of 2712	392	rundll32.exe	28
PID 392 wrote to memory of 2712	392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c96e457ccbe4772293a915b62ab540c4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c96e457ccbe4772293a915b62ab540c4.dll,#1
  2⤵
  PID:2712