b0dbbb1998e7f1a6817a964d86ca9de2b2b60ac09cd1f31be9e3b95c801d8fe1

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 22:08

Target

c57e380b68dbd4119868c2bb82e41959.dll
Size

318KB
MD5

c57e380b68dbd4119868c2bb82e41959
SHA1

5a59af356c4248ba36b34ef3ed6617a4513577cb
SHA256

b0dbbb1998e7f1a6817a964d86ca9de2b2b60ac09cd1f31be9e3b95c801d8fe1
SHA512

0150379354bb4cdd0e32f85ec36f1caa045d1a6b7c47095f14ff104e4df73f88592e086fbd68a47de75d29f25e359f647c8fc86f11cea9d2276699cb67682bcb
SSDEEP

6144:HRjpDvikUfaD9swnqXJ48k6f0XxS/tgCBYqd79OShBqs:J1in+aYqXJ48k6fcmTBYqd79PhBq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28
PID 1244 wrote to memory of 2280	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c57e380b68dbd4119868c2bb82e41959.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c57e380b68dbd4119868c2bb82e41959.dll,#1
  2⤵
  PID:2280