79369c7effa9d7a86e58216e21632cff27b056c154873fbe1daa9a335036e8c0

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 21:34

Target

184aac696669d53cedc817dacbdb8f28.dll
Size

7KB
MD5

184aac696669d53cedc817dacbdb8f28
SHA1

14c1602a93852120159943be23634a78b07d5117
SHA256

79369c7effa9d7a86e58216e21632cff27b056c154873fbe1daa9a335036e8c0
SHA512

f891e080ec9b256184d5b8ef5326194c977afaf6011954862030ad7357fcf59de18e1c9383a0546b80660412168c61031486778153bef5b6763ef908883ca1aa
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWbbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPpq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28
PID 2492 wrote to memory of 2700	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\184aac696669d53cedc817dacbdb8f28.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\184aac696669d53cedc817dacbdb8f28.dll,#1
  2⤵
  PID:2700