748c5480892a0888eb59e5511d6fe18e0f3aa0fe297539e3429c615d91b78fe6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 11:54

Target

cdff63b55714e9de3dadedba14c52c4a.dll
Size

80KB
MD5

cdff63b55714e9de3dadedba14c52c4a
SHA1

91b1fa7a75ea131792574250aae003c96ffeca16
SHA256

748c5480892a0888eb59e5511d6fe18e0f3aa0fe297539e3429c615d91b78fe6
SHA512

bd5be76a39d34b8693b253257c9eafd2c0ffba4dc8ba9b32f5e6bf178d3b4e75246ff8ed689976869e7e1402cd777e363d5c24ff11a3c885f23f453f1c5e9d60
SSDEEP

1536:3hgHvw2cBaHTVpPG5aQtvWwCbneb9yxr4nGYkH4/F8qX:xgPn6aHW5aazPyKn0H4d8q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdff63b55714e9de3dadedba14c52c4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdff63b55714e9de3dadedba14c52c4a.dll,#1
  2⤵
  PID:1952

memory/1952-0-0x0000000065190000-0x00000000651A8000-memory.dmp

Filesize
96KB

Download
memory/1952-1-0x0000000065190000-0x00000000651A8000-memory.dmp

Filesize
96KB

Download
memory/1952-2-0x0000000065190000-0x00000000651A8000-memory.dmp

Filesize
96KB

Download