fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 01:22

Target

fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll
Size

81KB
MD5

fbf6559769a9ae1165e0d37c6d14f54e
SHA1

7ba7508a0751522e30df5377c58cd61d24aa3d93
SHA256

fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b
SHA512

0fc1921fcd256c2c7461ede766f606f1b72092a563c67769fd63e03c41ba99ee6780ed2df9a86e1dbdf4f7f1069d3873b7496f281fb9f6dd3c47b8178a45cc19
SSDEEP

1536:cc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GH:z+5oxmqAiR8+/RBkez0U+c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28
PID 2368 wrote to memory of 1632	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb6088799263d5fb7ac9d109f74f3b2f10425abd1b72501a04759b917f5cf06b.dll,#1
  2⤵
  PID:1632