b48c742f0ab6fea55116f2f1fecf541985d989d687b598d61b2e617e1e40be2f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 03:16

Target

b48c742f0ab6fea55116f2f1fecf541985d989d687b598d61b2e617e1e40be2f.dll
Size

88KB
MD5

37fcf8096f61fc17f15c86b5b1f05869
SHA1

85ddfd5de498f2a05edb624680c54bd35eac3a07
SHA256

b48c742f0ab6fea55116f2f1fecf541985d989d687b598d61b2e617e1e40be2f
SHA512

3ec6ea538cf3cab878ba73490722fa94931627434b546cec05e76fdb3ae06ce91da7a9627638061f7b1dee26d102127df35ed82220b59e6c2c01cf9ac6afe802
SSDEEP

1536:vkgE46e6ILiE2G/5Cwh827LCHxZItFkPywrL0ltBTEf:sg6IWGxZqIVwrL0ltBk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28
PID 1680 wrote to memory of 2228	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b48c742f0ab6fea55116f2f1fecf541985d989d687b598d61b2e617e1e40be2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b48c742f0ab6fea55116f2f1fecf541985d989d687b598d61b2e617e1e40be2f.dll,#1
  2⤵
  PID:2228