de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 19:07

Target

de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll
Size

648KB
MD5

773ee7c6340a3b637f1d469c10753895
SHA1

640999f3973a354e6bd99ce13ce5936802644679
SHA256

de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3
SHA512

f61864c918448b3b275e8df8e536bff16501283400377bd0850c327cd3b3d872ea48349f34381d5f7e1eb6661a7b83a4e8b04dd84c180726a0230776139018a6
SSDEEP

12288:HjsgiZdvAeRwz+agHL50cCJeBqWycvpWwXkmvRKLiTOksRpFHDIkGiIjcBDQg5Ey:DsgwdvAKrr50cCJeBqW/vpfXkmvR+iT4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28
PID 1636 wrote to memory of 2740	1636	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll,#1
  2⤵
  PID:2740

memory/2740-0-0x0000000074A40000-0x0000000074AE2000-memory.dmp

Filesize
648KB

Download
memory/2740-1-0x0000000074A60000-0x0000000074B02000-memory.dmp

Filesize
648KB

Download