60d0afa692503bc41d820d3e6ba3b4892ee0f791da03a3b0e667cd285e441752

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 21:20

Target

60d0afa692503bc41d820d3e6ba3b4892ee0f791da03a3b0e667cd285e441752.dll
Size

7KB
MD5

dacccf8f24d1197a28f9965e9510a508
SHA1

3f4faf962125b8f60184e2df3e3731a408f66673
SHA256

60d0afa692503bc41d820d3e6ba3b4892ee0f791da03a3b0e667cd285e441752
SHA512

567f9f31899af3943e6b2a071ec7465e057191c3a1df51e8c6773bf43a0e8c6d0584036aa6f401bf2a9b08ccdf7351db0ea1325095fa6bfeff5386243226ede0
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWubABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP4q3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28
PID 1964 wrote to memory of 2272	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60d0afa692503bc41d820d3e6ba3b4892ee0f791da03a3b0e667cd285e441752.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60d0afa692503bc41d820d3e6ba3b4892ee0f791da03a3b0e667cd285e441752.dll,#1
  2⤵
  PID:2272