54c8cac96991ff0ffb9ab0ccff3484e3053d7e68b4b5781679d29caf9611a603

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 07:36

Target

d58f468e7d3f74e044cd06575ac70745.dll
Size

54KB
MD5

d58f468e7d3f74e044cd06575ac70745
SHA1

7594c4bfd8c8671654d35b0bb01bcef7a7e21bc5
SHA256

54c8cac96991ff0ffb9ab0ccff3484e3053d7e68b4b5781679d29caf9611a603
SHA512

35e866171589d25aec119dfff3c5eac9194370e1f6be62aad2c4bde91743ede2ef07ff4d025fbf80d59d11242571767f379480c7a55a182fe898f1f6c80c0375
SSDEEP

768:UIs8px/C9oQ3mbTCjMA2ycwrst4vHiaSZMQCqtDvF5gYs8L/IZFmiP7D4BlL4/kC:UInUmvCj/2lqHJOMQbU8wyiP7D6LLC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28
PID 2008 wrote to memory of 2248	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d58f468e7d3f74e044cd06575ac70745.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d58f468e7d3f74e044cd06575ac70745.dll,#1
  2⤵
  PID:2248

memory/2248-0-0x0000000000120000-0x0000000000132000-memory.dmp

Filesize
72KB

Download