b2392fae18ffa481b2e1a7f0a6bcf87405859c1406417390858bd0b938fd49cc

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 23:02

Target

949343512e2d6e3b29ba644d186192bc.dll
Size

7KB
MD5

949343512e2d6e3b29ba644d186192bc
SHA1

ca7385a43d9548cdd0b4f2cf8680b583f7b78a1a
SHA256

b2392fae18ffa481b2e1a7f0a6bcf87405859c1406417390858bd0b938fd49cc
SHA512

a6eeb141f87a8f8a632f5d1130d6ff505ab92e4ae30df17e5a252bb8cc47e4a0568271a8a21bda11dd6981959c8d8a54665786bcb2fe1ddcb0b67e1aa94b9b72
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW7bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPlq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\949343512e2d6e3b29ba644d186192bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\949343512e2d6e3b29ba644d186192bc.dll,#1
  2⤵
  PID:1656