73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 22:45

Target

73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd.dll
Size

135KB
MD5

cd28fda418470f3eb692e230e8e928fd
SHA1

e9d724df04bbb415126203a9420a1ce79d89b5a3
SHA256

73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd
SHA512

040c63d0305a50597fc13e82d10e93bd69f4719c4165d850634fb6b83f4bd649cecafbf03fcdd0b6ada0eab98ec93bd60302563f29d097f8e256712bfa4943e9
SSDEEP

3072:+rxH+fulSq6qEfTvyHoBbnS4frBdZoJBLvPAa:+rxH+fulSqlHHqbnSyfZoJxoa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28
PID 2856 wrote to memory of 2852	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd.dll,#1
  2⤵
  PID:2852