42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 10:14

Target

42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50.dll
Size

921KB
MD5

117d9f1422626dd8b35837a9ec6b6043
SHA1

1c5fd9ce0e62e27c0d55d31af4e5b8756f6df4bb
SHA256

42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50
SHA512

71d725591c4af89dfe72f403cdcf846f152cc5dc025a39a46aa2cda0710c224c2c88152e9b7e2620e38ba326d4d7da99f288f97c9c0cba08062d1b0d39ba9be8
SSDEEP

24576:PRx7FM7sNv+76dJLWbB7HmEArPpbZYJE7dxWy:j27sB32qtrh2sdxr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 952	1736	rundll32.exe	28
PID 1736 wrote to memory of 952	1736	rundll32.exe	28
PID 1736 wrote to memory of 952	1736	rundll32.exe	28
PID 1736 wrote to memory of 952	1736	rundll32.exe	28
PID 1736 wrote to memory of 952	1736	rundll32.exe	28
PID 1736 wrote to memory of 952	1736	rundll32.exe	28
PID 1736 wrote to memory of 952	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42ddf242f0657ea33454e93cc6a06316cf28c47a0d2f12cefbc266460a0e5e50.dll,#1
  2⤵
  PID:952

memory/952-1-0x0000000074EC0000-0x0000000075085000-memory.dmp

Filesize
1.8MB

Download
memory/952-2-0x0000000074EC0000-0x0000000075085000-memory.dmp

Filesize
1.8MB

Download
memory/952-3-0x0000000074EC0000-0x0000000075085000-memory.dmp

Filesize
1.8MB

Download
memory/952-0-0x0000000074ED0000-0x0000000075095000-memory.dmp

Filesize
1.8MB

Download
memory/952-4-0x0000000074CF0000-0x0000000074EB5000-memory.dmp

Filesize
1.8MB

Download