a823f0ec1c0a63bb9c1d811db90d213ef2177ef3ce50b0912634dd72c43f3c2b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 23:37

Target

f09660031b7eda56a2c09cce2adc7fd0.dll
Size

7KB
MD5

f09660031b7eda56a2c09cce2adc7fd0
SHA1

d21e8cee0eceb8e9a472ab6f22c05684599488bc
SHA256

a823f0ec1c0a63bb9c1d811db90d213ef2177ef3ce50b0912634dd72c43f3c2b
SHA512

ef1e0da5fe4f4aa70d0d5f64c18f9b1379c426022dc962e6df0ee5f7551c6b92282b8df0ce7748e8273f37bcb78fc336528fe22505034837264cfd81579626b4
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWe7bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPtAq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28
PID 1100 wrote to memory of 2244	1100	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f09660031b7eda56a2c09cce2adc7fd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f09660031b7eda56a2c09cce2adc7fd0.dll,#1
  2⤵
  PID:2244