c7f87439464281a9da66e54f9d4e062cf23903ae6f2d1ca2a644610175b87164

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 17:42

Target

cc06b44a59a23f92751d1d958d6f14f7.dll
Size

47KB
MD5

cc06b44a59a23f92751d1d958d6f14f7
SHA1

46a6ed22bbc166771fac0880d9bc98b0a07eb31a
SHA256

c7f87439464281a9da66e54f9d4e062cf23903ae6f2d1ca2a644610175b87164
SHA512

141226d743050c8320d017c10ca31f1eca7b302abb38595f1dee52b93ea5687434061b95ba569131bbef005f4872a0049e2824529f0f12d4f7c068c96b3ca26b
SSDEEP

768:ma0xsOFusTKAx3o/jsbfSHoJG0UcajLvxN7GojXApcrxm//moReTHE9T:10xsDsTKoo/jsNmcav+4j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28
PID 3052 wrote to memory of 1968	3052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc06b44a59a23f92751d1d958d6f14f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc06b44a59a23f92751d1d958d6f14f7.dll,#1
  2⤵
  PID:1968

memory/1968-0-0x0000000000160000-0x0000000000181000-memory.dmp

Filesize
132KB

Download
memory/1968-1-0x0000000000160000-0x0000000000181000-memory.dmp

Filesize
132KB

Download
memory/1968-2-0x0000000000170000-0x0000000000191000-memory.dmp

Filesize
132KB

Download
memory/1968-3-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download