0ce3dd3db854014728a5b4f6743df5d0831920a2786c379583cefbd2cd7c7ee9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 06:54

Target

cd668be1f97bcc9a794c664b90a02ff2.dll
Size

100KB
MD5

cd668be1f97bcc9a794c664b90a02ff2
SHA1

73b25fa86c04db352ab191b67816f67aff517bb0
SHA256

0ce3dd3db854014728a5b4f6743df5d0831920a2786c379583cefbd2cd7c7ee9
SHA512

4bd8c834c4069e290f164bed548e74bfa4168a59c8fbe32e8f7de164a4aa2ba31774facb697669ac878ed7af6eb57638734f8dd8dff708ae6dcf27671c0b7f93
SSDEEP

1536:HUte7/RZ1PqVN2qwNQ3EMdswDDWMiJ4FZQ5emRqtV28MJ3HBvD8/Kpxd:HUtS5uzpPM2ZlmotBMJe/Kp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28
PID 1940 wrote to memory of 1660	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd668be1f97bcc9a794c664b90a02ff2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd668be1f97bcc9a794c664b90a02ff2.dll,#1
  2⤵
  PID:1660

memory/1660-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download