21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 18:15

Target

21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1.dll
Size

25KB
MD5

aaf2b22939730cfc147dc188c82acdff
SHA1

3b2c32441363b4aba608487b766a0c9c69e60254
SHA256

21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1
SHA512

6a56bd48fe66a24eefa6653a0581e25481d27f93188f5333fde0e3c757ef8772149aa4a42aca6867e1e4b89c3b60e91f8bdea52dbbd592557bd38ff867cc2a07
SSDEEP

384:UUFNNNqJMlMEDqzaoBfn8+n+8IeyGKCKEmVr9Cy8JN77hhQb:JNNwuiHaou++8IjVrcd3hmb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28
PID 2368 wrote to memory of 2212	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21e795e3e6a1ad6ac4b4c300b72f232b7e7f6beaa075e39b2a6ecbd67833e5f1.dll,#1
  2⤵
  PID:2212