75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 23:06

Target

75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277.dll
Size

6KB
MD5

ea99b6492fc6ab9cbe7da9ffeeb14766
SHA1

b52799620be54ec62233b76d9c988039ee67beeb
SHA256

75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277
SHA512

3cc5e4cb7db547399881e7847aa5243f5f46d556b7e8360f2578eaa5b875e141b26756b8d54f70d252af107593c2c79bf9e44ef096be48528b56e1321235b003
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIqfQyZbtZpfHwSQwGAGp/a:unSR6bgY9frZxZp+dpS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28
PID 1380 wrote to memory of 2200	1380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75391f55b84cd14458cac7d6af345a4564691e5aaaaf9ab1dec28dadaf1a5277.dll,#1
  2⤵
  PID:2200