6e9583e41c52bbfb267e0c49be6201fc20e94d2a308844edac7983ca66235c55

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 19:57

Target

d6fd42bf20d0e77ff379e972004132f0.dll
Size

74KB
MD5

d6fd42bf20d0e77ff379e972004132f0
SHA1

3fec1f7e771e95001ede58ca0e1268cc5f7ba14a
SHA256

6e9583e41c52bbfb267e0c49be6201fc20e94d2a308844edac7983ca66235c55
SHA512

fb335a99c9209a31b06be261b498533fb716ec7e2c5f8d5f3d88b581e0546c1b51c7e3656dc3c93edcecc146ee88627fb2094fa1abc2ecb343c28b666a4fd0d6
SSDEEP

1536:cGZ5nvA2HEb2vWhfU6fLPqNW4AUw+MoXkaRcUP1IgpN2p:cGouEGU9+NfA/BgVPCgf2p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6fd42bf20d0e77ff379e972004132f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6fd42bf20d0e77ff379e972004132f0.dll,#1
  2⤵
  PID:2860

memory/2860-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download