092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 18:21

Target

092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469.dll
Size

6KB
MD5

902b348f01ac21ece70ca33043f4244c
SHA1

9730191ca661d2d362af13479ea232600a6c6a8d
SHA256

092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469
SHA512

25f5fcb2a8c38091bdcb35f9b9989f4a98198456ba71b1efa373470dea6fae9f3538e2ec6df5fe17cd025b44e8fd1e343eb033b9f29258e16d5fe6ef954382c3
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0LB+BDq9J5SH:VDa9VUX9bQWrB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\092a2d44643b1f5e1b4d2462a7a467994dbe7ea914cc050a393f9ebd30c51469.dll,#1
  2⤵
  PID:2780