2dafc805ddec14ee77d96cc21000a221e1a15ae8e114090a1c8de9ddcbee17dc

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 20:36

Target

e9f755384913c018513594428e426347.dll
Size

33KB
MD5

e9f755384913c018513594428e426347
SHA1

3aa8c50e24af91ae8499752eeff4b1cad3c06e65
SHA256

2dafc805ddec14ee77d96cc21000a221e1a15ae8e114090a1c8de9ddcbee17dc
SHA512

55c7c4a344f1634e8a4b2cdbec09973ba74a36496b6e69b49c8416dfc21abbf60e70dde4bf4dc531d6d910b4858f67c366700d9a228828cbfd3b97e45dd4d906
SSDEEP

768:GGC39bq5oxE2AdR40kYO2lg7EW1DdgI5hqDMTR5b+5:GGwgAEw0kY87EWddgWk+Rd+5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27
PID 2652 wrote to memory of 2664	2652	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9f755384913c018513594428e426347.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9f755384913c018513594428e426347.dll,#1
  2⤵
  PID:2664