5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 19:30

Target

5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509.dll
Size

12KB
MD5

e409740ca973a2374a137b62622261f2
SHA1

fbd8b7950064d2424e42b5293c7658ce14eac713
SHA256

5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509
SHA512

17e916132794bbf465281b59e7ba39f5cdf663496cda37b90faeca2c2729fc28326f07d52b7bb0fc33f91cf0279821c542cbcac5347b2b0f8db3072943cf4b9b
SSDEEP

192:izTyH59ZEOGECXOh7nsrdnD1QW6jOMeS09iL03DyIjJRtdt:izTyH2PSsrt18jxlIWIPtn

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2956 set thread context of 2976 2956 rundll32.exe rundll32.exe

description	pid	process	target process
PID 2956 set thread context of 2976	2956	rundll32.exe	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2956	2948	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5327aaa8ae666d71d5e05932d348b7c78a2cc5abb927a1036f90a444d06ab509.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948

memory/2976-0-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download