27f31860fd9f2a5b127f0d13972cd0a9d3f589a9add6fa0d7feac606f2a7cb5b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 03:51

Target
russian.dll
Size 124KB
Sample240408-eepyraga24
SHA256 9900a23bf7d7f4b5e9343b6f37a8406ddeb302ebe1d9fcf382b1c408b7dc36e7
MD5 f8d4f0bc57b49287b04ed40a4c68d2ea
SHA1 9d38d930eeaa710ef1ad6da16456563d3b008b4f
SHA512 1c02fde05d653e187371b1757616173b6278f7447ec18f1103be76daa5868f70dc67b5e1a35faaddae6f6c0ecdafcf6ab9c23ecb849757764cb8fec96b3f60ea
SSDEEP 1536:IH1COcV/476GMfQmthLlHu52bAig/y37B2wpAjTiqcGalVVe4EafQsk5A:KA/47iLl9Uici7GLNalTe4lk5A
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28
PID 1976 wrote to memory of 2860	1976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\russian.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\russian.dll,#1
  2⤵
  PID:2860

memory/2860-0-0x0000000075100000-0x000000007516D000-memory.dmp

Download

memory/2860-1-0x0000000075110000-0x000000007517D000-memory.dmp

Download

memory/2860-2-0x00000000750A0000-0x000000007510D000-memory.dmp

Download