d53affef6e993d23f67a7bb30c534a90b2b148e26e406294629055fbd3dd58b2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 22:07

Target

d53affef6e993d23f67a7bb30c534a90b2b148e26e406294629055fbd3dd58b2.dll
Size

397KB
MD5

0ab43a8a193de4dbe4ae600ab7eec684
SHA1

5351b490fefd338f963af3212cb7e4f211ef6343
SHA256

d53affef6e993d23f67a7bb30c534a90b2b148e26e406294629055fbd3dd58b2
SHA512

ca1d49f0b94852380bd8fe24329ee7084fc9a1912f3372fd38af9aacda5808801a11453f619c36dfd30a0b2d3448d7f29280e212c8d471ac2cc21c34c18c6241
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaL:174g2LDeiPDImOkx2LIaL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28
PID 2800 wrote to memory of 2848	2800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d53affef6e993d23f67a7bb30c534a90b2b148e26e406294629055fbd3dd58b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d53affef6e993d23f67a7bb30c534a90b2b148e26e406294629055fbd3dd58b2.dll,#1
  2⤵
  PID:2848