96d8cc815f3da859b3d57c86e04c15dcde2082272fbfe66154fd487f0e9ff19d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 01:02

Target

d786c727bb1666d3b139860658407363.dll
Size

42KB
MD5

d786c727bb1666d3b139860658407363
SHA1

dd45c923476642356479913e2e8eb22d6d49836a
SHA256

96d8cc815f3da859b3d57c86e04c15dcde2082272fbfe66154fd487f0e9ff19d
SHA512

a19d41eb35a8e53d42804f94ff729ac140643a0493f52e3df2bab87dcf16b3b018feab0de8986a8b4c2cf0b538cc0264c6679fc091bb358b2159c5b192daa2fe
SSDEEP

768:tE1obGm7B9iFLFjPjCkN95r8r2k1/+SJOydXm1o9Iv:m1gB9iFL57D9MV1/+6h2o2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28
PID 2208 wrote to memory of 1636	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d786c727bb1666d3b139860658407363.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d786c727bb1666d3b139860658407363.dll,#1
  2⤵
  PID:1636

memory/1636-0-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1636-1-0x00000000009A0000-0x0000000000A76000-memory.dmp

Filesize
856KB

Download