83ac3aa3ddb2b4e61e491fd285964333d0aff50a48cc2d19648f4b29f2166cf8

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 07:27

Target

$TEMP/R2RS1KG2.dll
Size

729KB
MD5

90f4d27517acc223d1698e6d189861e9
SHA1

070ca52f21232bbd9e1e99ef87a339dea43efb0b
SHA256

d53db9201a4a0ba627f107739398be8b16e8618d06fa88eed476026a43a4cc6e
SHA512

289daf70f5e97b304721ec249cac284f621c6606b84e832049747f264be464acbf7f9dfdbe7b39b18ea1c25754158cb0fa472b70ab70a9a3b3163acba2a308cd
SSDEEP

12288:5dvLDWGJ0E2gUPxrDIRYB/0hzYSmujEMPYKHWkQTnl1wEFHysG56E982x8ozOGzH:5dvLDWGr2/xpSmuUnlI6U82RzaE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28
PID 2156 wrote to memory of 2408	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RS1KG2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RS1KG2.dll,#1
  2⤵
  PID:2408