38ce33fa0a7a54e427b451f4d070b6d13c41047e6e16b75255b42f6c4af8a076

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 20:34

Target

38ce33fa0a7a54e427b451f4d070b6d13c41047e6e16b75255b42f6c4af8a076.dll
Size

6KB
MD5

c56811be4258e94c7212889d87d59bc0
SHA1

d146e36a0ee4c87822c0fd47230cd563e5e3e1b9
SHA256

38ce33fa0a7a54e427b451f4d070b6d13c41047e6e16b75255b42f6c4af8a076
SHA512

9a38a267f0a1306ba9e6cab90b7c6acbbb7926e9f5c28df51434c46c04ad46fb760ddccb494c0eedf401ac05ce38c62a4cc4fec4c7c16313208895e4277cdc55
SSDEEP

96:VGEETrMLH5b8HztopJSqPWCy2LObIxoMI:efMRapopJSqPVy2LqIxrI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28
PID 2168 wrote to memory of 2884	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ce33fa0a7a54e427b451f4d070b6d13c41047e6e16b75255b42f6c4af8a076.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ce33fa0a7a54e427b451f4d070b6d13c41047e6e16b75255b42f6c4af8a076.dll,#1
  2⤵
  PID:2884