0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 18:31

Target

0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9.dll
Size

439KB
MD5

857f3e5568a6dd96eeb15d04021fec2e
SHA1

12e16107a5d314b18c2553de37d81265420e2692
SHA256

0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9
SHA512

1020c9ccd8d0eb822d7579fe6dd3de66f46845c7578932f47482c17518b706d212ad21061bd2c53d5a475529f181308057e533ad43a3694a3114cc8f1bbaa949
SSDEEP

6144:t5ZbwYs0Kje4bKTcl6yRbFY5hNktoZHyLIl5eWPoJmbiMjoJ+l:DZbwmBdTO6ykAoksx0JU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1936	780	rundll32.exe	28
PID 780 wrote to memory of 1936	780	rundll32.exe	28
PID 780 wrote to memory of 1936	780	rundll32.exe	28
PID 780 wrote to memory of 1936	780	rundll32.exe	28
PID 780 wrote to memory of 1936	780	rundll32.exe	28
PID 780 wrote to memory of 1936	780	rundll32.exe	28
PID 780 wrote to memory of 1936	780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9.dll,#1
  2⤵
  PID:1936

memory/1936-0-0x0000000000230000-0x00000000002A4000-memory.dmp

Filesize
464KB

Download