b1913f8d2fafabc887b76ec92471ab57376c9c677b9b06aec12cdb5567030525

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 23:43

Target

b1913f8d2fafabc887b76ec92471ab57376c9c677b9b06aec12cdb5567030525.dll
Size

6KB
MD5

63ba17312f7d9fb01409238f305481ad
SHA1

29d884bfe9d30493745df165f35880722365c088
SHA256

b1913f8d2fafabc887b76ec92471ab57376c9c677b9b06aec12cdb5567030525
SHA512

e32cf8934c6ef4c998ee1561c9fb462070ec5881fb140c59b5d66350dec648a058de2df850b6555d0571f412a22ea4e914afbe4755a1f3bb72d4b15260d52863
SSDEEP

96:hy859x0P8MaYvBW93IgB56uY9netsoRQ/v60OeH:F5oLHBy30PneSuQ/vO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28
PID 3048 wrote to memory of 2928	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1913f8d2fafabc887b76ec92471ab57376c9c677b9b06aec12cdb5567030525.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1913f8d2fafabc887b76ec92471ab57376c9c677b9b06aec12cdb5567030525.dll,#1
  2⤵
  PID:2928