92e5a2fb9c2403bcdfffc5d91c7cc959da76e0ddd843b2d43a8a3a858f9c90a6

Analysis

max time kernel
88s
max time network
95s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:53

Reason

Machine shutdown

Target

5c959580adf1fbdfea872ece4d29ee6a8319a88273a9923988ef8be4197833bd.dll
Size

161KB
MD5

3a54e0c4d396020138af9ca801dbe28c
SHA1

5b1d56afb3080979918881f39068bcabc4ed7c42
SHA256

5c959580adf1fbdfea872ece4d29ee6a8319a88273a9923988ef8be4197833bd
SHA512

a5969ae88fddf490701c887a42b2101d253838e2e144ac944af278d370e392f58cd68e6db47c43ab2a04740d2e44a1d1e5bc444a953339112fcc32ee6722668d
SSDEEP

1536:7mseS0rh3UharM4WHMnEA0tepkq8e7Pbi4eTMluxtXDCntTnICS4ADEqIvdb3G6V:tsM4oA0tCHLbi4eTMlwDCnuSqeF3Gj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe
PID 2244 wrote to memory of 3008	2244	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c959580adf1fbdfea872ece4d29ee6a8319a88273a9923988ef8be4197833bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c959580adf1fbdfea872ece4d29ee6a8319a88273a9923988ef8be4197833bd.dll,#1
2⤵
PID:3008

memory/1828-14-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2568-13-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/3008-2-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/3008-5-0x0000000002F90000-0x00000000030BD000-memory.dmp

Filesize
1.2MB

Download
memory/3008-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/3008-4-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/3008-0-0x0000000000160000-0x000000000016A000-memory.dmp

Filesize
40KB

Download
memory/3008-7-0x00000000006B0000-0x00000000006CF000-memory.dmp

Filesize
124KB

Download
memory/3008-9-0x00000000033E0000-0x00000000034E9000-memory.dmp

Filesize
1.0MB

Download
memory/3008-8-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3008-10-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/3008-3-0x0000000002AD0000-0x0000000002B6F000-memory.dmp

Filesize
636KB

Download
memory/3008-1-0x0000000000C40000-0x0000000000D09000-memory.dmp

Filesize
804KB

Download