5398b966d6e50cc4c6d65103b598ae50b153c02c77cc972db2baf8c2963b8403

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 20:51

Target

5398b966d6e50cc4c6d65103b598ae50b153c02c77cc972db2baf8c2963b8403.dll
Size

6KB
MD5

035b74045671c0de8a5ca44c5aa6b0f2
SHA1

6df5f2bf86f01260616b1c322c1cb19cc19c58fe
SHA256

5398b966d6e50cc4c6d65103b598ae50b153c02c77cc972db2baf8c2963b8403
SHA512

05cc4cbb6358c70fb3bb901690eba8707b32f19d862e6c7efa123ee0aade1a6d1aa0729f42120eb8c67580ed8811b25d079a3b008e3858f281f6872c1b00709e
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0AB+BDq9J5SH:VDa9VUX9bQWgB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5398b966d6e50cc4c6d65103b598ae50b153c02c77cc972db2baf8c2963b8403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5398b966d6e50cc4c6d65103b598ae50b153c02c77cc972db2baf8c2963b8403.dll,#1
  2⤵
  PID:1740