a977aac14232e0909b05dd5637165bb31aeccf291d439c1a8550899f54f64945

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 23:23

Target

c435d22682c71cd6d6b34d8b86712fb5.dll
Size

7KB
MD5

c435d22682c71cd6d6b34d8b86712fb5
SHA1

8276be5f72607b250b1ffbbd834c47e5ddbe326c
SHA256

a977aac14232e0909b05dd5637165bb31aeccf291d439c1a8550899f54f64945
SHA512

fbe6214a2aabf9511f5a5dfcc8744a7f8785f26f36be651c4e4bd06796b92cbc4cd6ac11865839d3064fde7db36f3249c125738ba9c1b51da9246af6aa403f0f
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWlbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPbq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28
PID 1640 wrote to memory of 2264	1640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c435d22682c71cd6d6b34d8b86712fb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c435d22682c71cd6d6b34d8b86712fb5.dll,#1
  2⤵
  PID:2264