b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 00:24

Target

b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb.dll
Size

6KB
MD5

912a3e1c1cb9a96ed2da097895c8dc04
SHA1

6d81a930402101e219edacb3d7a579114e763d3c
SHA256

b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb
SHA512

fd1a5ba4840311590724cf0c70b798d960e911fe2f724153e42e52eb3bd1e234f9143daf588e9620af320b539fda8945df5d268bab9bfef4c5f8bfecda3203c8
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0+B+BDq9J5S9:piFVE/y6okJqB+FqX5S9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28
PID 2936 wrote to memory of 2476	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9edc02be49e953a61cba7d7dde45cb19ac4b8975ec79f329808ba0d751ba4cb.dll,#1
  2⤵
  PID:2476