a51f1bdca68310a38722bbd5c49ab380f875d2efce683c825b110fda089db738

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 00:58

Target

a51f1bdca68310a38722bbd5c49ab380f875d2efce683c825b110fda089db738.dll
Size

6KB
MD5

1fedfe1e81468f9c226cea1096d97aca
SHA1

fd23c0925d54bcd4f303878e70a9db9901467f6c
SHA256

a51f1bdca68310a38722bbd5c49ab380f875d2efce683c825b110fda089db738
SHA512

0c5b9f7520bc907716c13e990c58118debd898cf563e7fd666274e06b3e96a5c77d915f9614bd577cb9d655a31e3d56eb959f7e1c10cdb92933f6cf10bd509b8
SSDEEP

48:SfIBj0W6/aGxkaklS4rklStklSd8klSPklSTIZGifi5qwlGsPvwxWq38FZ9Pz5nb:DixZjmjtjd8jPjcZGR5TInSb4FLIEhE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a51f1bdca68310a38722bbd5c49ab380f875d2efce683c825b110fda089db738.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a51f1bdca68310a38722bbd5c49ab380f875d2efce683c825b110fda089db738.dll,#1
  2⤵
  PID:2132