b6b473efb4b70f30b93c2bdf96ac1f8d8a058655478211dae931281de2a4e1d7

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 02:07

Target

b6b473efb4b70f30b93c2bdf96ac1f8d8a058655478211dae931281de2a4e1d7.dll
Size

81KB
MD5

e5cf31bd9c83c826a4bbd8785466de04
SHA1

85ac491ab2406b92253bbc42d8821d2a93226a30
SHA256

b6b473efb4b70f30b93c2bdf96ac1f8d8a058655478211dae931281de2a4e1d7
SHA512

0cb744ae5e5c389247836d115fc293770230c9d7f77b41f54ac8d25e53ad0ab363efee026e58f4c5cc32ca0411af25741404ced0fa8b78938183000bd191dbdd
SSDEEP

1536:KByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wz:Lv4JKXTx71wnArSsXFpeXq8Wz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28
PID 1600 wrote to memory of 2980	1600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b473efb4b70f30b93c2bdf96ac1f8d8a058655478211dae931281de2a4e1d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6b473efb4b70f30b93c2bdf96ac1f8d8a058655478211dae931281de2a4e1d7.dll,#1
  2⤵
  PID:2980