2215c3f6b42f4beda0752264db78178531e4ee4f72a86fc8edfca0d0e656d7d8

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 09:57

Target

2215c3f6b42f4beda0752264db78178531e4ee4f72a86fc8edfca0d0e656d7d8.dll
Size

36KB
MD5

8cf00991ccd7a81aeff741ce5b14df69
SHA1

4cd86304365b39abe253d7172e92257e67d36c3b
SHA256

2215c3f6b42f4beda0752264db78178531e4ee4f72a86fc8edfca0d0e656d7d8
SHA512

d7422ae02ed9c693752595b08a33eacfa6bd8f8769fc554aaa9849fe83a7c22243d5d2b88b929a0e493c5bbc5228a13a6f896392243b790061882fc2f320e704
SSDEEP

768:B9aZ/adyHjt2hLFsTUOsk23NZKju/eEl:B+t2hLFsTUO0EuG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28
PID 1756 wrote to memory of 2120	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2215c3f6b42f4beda0752264db78178531e4ee4f72a86fc8edfca0d0e656d7d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2215c3f6b42f4beda0752264db78178531e4ee4f72a86fc8edfca0d0e656d7d8.dll,#1
  2⤵
  PID:2120