1660b10c69856698663f691f580ddd3eb88027d61af33d2c35acbfabca8b49ab

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 18:48

Target

1660b10c69856698663f691f580ddd3eb88027d61af33d2c35acbfabca8b49ab.dll
Size

7KB
MD5

37e2037d2fc0d02cf4c23b2b5a08622e
SHA1

73f86bc3a9b04a70d7178a784188a58f770aa89c
SHA256

1660b10c69856698663f691f580ddd3eb88027d61af33d2c35acbfabca8b49ab
SHA512

01b52bcad8eeda711350e8f687966b326fdebd5175c1dd79588545b0074fc9822e34589f9b6f730db48e40497543a22fde5d44ff99623723f07913dbe31ce842
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWEbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPqq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28
PID 1648 wrote to memory of 2148	1648	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660b10c69856698663f691f580ddd3eb88027d61af33d2c35acbfabca8b49ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660b10c69856698663f691f580ddd3eb88027d61af33d2c35acbfabca8b49ab.dll,#1
  2⤵
  PID:2148