f92aba56b8a8252cc443ab2c7e6ce51a544f8c2b04369bb9e2d3a0576ca2066d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 02:38

Target

f92aba56b8a8252cc443ab2c7e6ce51a544f8c2b04369bb9e2d3a0576ca2066d.dll
Size

81KB
MD5

6815c6dc68a9a45c9a2967a53bde512f
SHA1

ca0354e445cfa0eed601353f57ba5e113c007225
SHA256

f92aba56b8a8252cc443ab2c7e6ce51a544f8c2b04369bb9e2d3a0576ca2066d
SHA512

a8974e8a2dfa90c3d77ed2b67197f12c23767723f7888518cd7973e408d207365b7a47dd3fdd44e46ea3fc5ee24bf4c8a184a3174db6483bee8d857e3c6997e4
SSDEEP

1536:h9ER9ve+HW4A6yKr7ownTxgAJnPKwuUSoosWaocdBSheDQU+Gv:zEe0zA6yKFdgC/RBSheDQU+g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28
PID 1676 wrote to memory of 1252	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f92aba56b8a8252cc443ab2c7e6ce51a544f8c2b04369bb9e2d3a0576ca2066d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f92aba56b8a8252cc443ab2c7e6ce51a544f8c2b04369bb9e2d3a0576ca2066d.dll,#1
  2⤵
  PID:1252