3ecc0a3851d55f47045678d3676d5b0a51cb8a0a1adb14e184d7d838404ca03c

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 19:16

Target

21caca364a7fe7ca4557bfbcddb7a6e9.dll
Size

81KB
MD5

21caca364a7fe7ca4557bfbcddb7a6e9
SHA1

e6b3b9ff9d40f6cbdd28737d2e2323cfbb9ea7fa
SHA256

3ecc0a3851d55f47045678d3676d5b0a51cb8a0a1adb14e184d7d838404ca03c
SHA512

0abefa23578700ae16e27f99f06a79aa036a505308169721f991afec5327c7aaf40b00806d1cdd043978ae1dd87c0fe729a639ef9796943992f625f695d3b5ed
SSDEEP

1536:dc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GH:a+5oxmqAiR8+/RBkez0U+c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28
PID 2160 wrote to memory of 2196	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21caca364a7fe7ca4557bfbcddb7a6e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21caca364a7fe7ca4557bfbcddb7a6e9.dll,#1
  2⤵
  PID:2196