2151c2922997e073ebe1d7926f08cd1b32f3cec9c30acea15e5ffd63d2e54796

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 18:10

Target
Config/$_7_.dll
Size 1.2MB
Sample240315-wscc9afd2z
SHA256 5079da9a198cadf7de66b1cf9730a83f9091ec0d82811ce719ba88ae1eb7b95f
MD5 84deaf8a86f90f3b6dc1476c30c13a29
SHA1 f0af6b51b89e801d77d8cc65a4570da95da2e2c9
SHA512 ae22dffb88df05b3fcb1309632eab4d458ed38c98968c684e172f3abb4d8e74016e7cf7185a0ea085f671bf446b4b67528c4d80470d0fc2bb4d8ff4fc032e62a
SSDEEP 24576:8qcrFtLUMtNv+h2d8pNmfQS+gbqimM0bG1aja1pFd:itgMjmh2dQmfAgbwM0wajaDFd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 548	3040	rundll32.exe	28
PID 3040 wrote to memory of 548	3040	rundll32.exe	28
PID 3040 wrote to memory of 548	3040	rundll32.exe	28
PID 3040 wrote to memory of 548	3040	rundll32.exe	28
PID 3040 wrote to memory of 548	3040	rundll32.exe	28
PID 3040 wrote to memory of 548	3040	rundll32.exe	28
PID 3040 wrote to memory of 548	3040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\$_7_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Config\$_7_.dll,#1
  2⤵
  PID:548

memory/548-0-0x0000000010000000-0x0000000010232000-memory.dmp

Download

memory/548-1-0x0000000010000000-0x0000000010232000-memory.dmp

Download

memory/548-2-0x0000000010000000-0x0000000010232000-memory.dmp

Download

memory/548-3-0x0000000010000000-0x0000000010232000-memory.dmp

Download

memory/548-4-0x0000000000370000-0x00000000003C2000-memory.dmp

Download

memory/548-5-0x0000000000370000-0x00000000003C2000-memory.dmp

Download

memory/548-6-0x0000000000370000-0x00000000003C2000-memory.dmp

Download