5553df099638358f00c4347e16cc827f3099bef639183c42b0d3de3d678c66d3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 20:56

Target

5553df099638358f00c4347e16cc827f3099bef639183c42b0d3de3d678c66d3.dll
Size

6KB
MD5

9283f7dfb1ac1209b1dc73436a3fb105
SHA1

960536dbb5a6419ada261cf9e2af80c2e1658f69
SHA256

5553df099638358f00c4347e16cc827f3099bef639183c42b0d3de3d678c66d3
SHA512

abf9d4d25865af6ff3a7fe1142d1ad713e897039274b4f266808a8af281f3cfd468106377bc769c4f693a5fb60cdb2dae6b4cc3650047149f2376c9a9d84a808
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0XB+BDq9J5S2:0QDV8FscMjsLFV3/B+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28
PID 3028 wrote to memory of 1984	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5553df099638358f00c4347e16cc827f3099bef639183c42b0d3de3d678c66d3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5553df099638358f00c4347e16cc827f3099bef639183c42b0d3de3d678c66d3.dll,#1
  2⤵
  PID:1984