9d741ad434584428e3611fdca3c3ed35c70a6eb8c29d8b48c5008f3576e45903

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 05:16

Target

ca9300a8d6151253f9ce51918d1cafc7.dll
Size

72KB
MD5

ca9300a8d6151253f9ce51918d1cafc7
SHA1

74c91d2a1e35ec46b8489c58be887af681735bfc
SHA256

9d741ad434584428e3611fdca3c3ed35c70a6eb8c29d8b48c5008f3576e45903
SHA512

b29b2b938eae2bd1f5d769dabf35b827c6ea7f53941177cb88e8405fb455beffea95616a9d5ecdd34e573fe6daa71f2857707a101be1b09c6049aa532e9c80c0
SSDEEP

768:2bTFaZs4A5nEFG+8y/1s1QvowMsfBIlPWQOK0cXuzcDmcbwXFPRoKtn2:2sBAtFSs11EutaKNeCmJPRnx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca9300a8d6151253f9ce51918d1cafc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca9300a8d6151253f9ce51918d1cafc7.dll,#1
  2⤵
  PID:2932