6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-03-2024 22:04

Target

6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll
Size

72KB
MD5

dd6257665f634b5566e15bc62e90c809
SHA1

54ded03f7b82c8aa4de10e673b556d0ba778177d
SHA256

6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab
SHA512

60e6297803141206a2ef9c30c028fb87581205623774e4c43ef4566dd42b61faf8d85fb3ddca2ec516448500dd392c01bdfb781c1bacd38b6c0a04837237eb85
SSDEEP

1536:CZYCKkPkDwBycMjIBbzreg/+UgOiALGr05:CZYCKkPkc7bHpdpin05

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28
PID 2224 wrote to memory of 2816	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6095f96dd5eca96a3fb9338eec4ab574921c0febb36f6a6db60aae1aeb9ffcab.dll,#1
  2⤵
  PID:2816