13055e34a28d8cd5d2d67bfb439a4a4cfa77dbdc1e72eb94aeae59b7b87981c4

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 03:20

Target

ccf93642085be74710f350cebb6755e9.dll
Size

192KB
MD5

ccf93642085be74710f350cebb6755e9
SHA1

5b3a95ba4bbcecbd017ee88eea63bc99847cfe14
SHA256

13055e34a28d8cd5d2d67bfb439a4a4cfa77dbdc1e72eb94aeae59b7b87981c4
SHA512

877520d2e0dd50ac1ad990c24801456d9fba7fcf9932e4c8558cd75c7d2d644654018013948deaf162149933cc17e53aee235d9671cdba9001846e04ee6e1112
SSDEEP

3072:1NbpOnPsGqQTruHLD7RcQxKrrdNU0VAtrOpOOWxOv4Kn7qbjx7T/Hrm5e:1NbqaLD7RcukVAtSQOWcgWqbV77LmY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28
PID 1656 wrote to memory of 2252	1656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf93642085be74710f350cebb6755e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccf93642085be74710f350cebb6755e9.dll,#1
  2⤵
  PID:2252