ab5ab21678c7895f9375778f52798888d06ed9e35a021c53c3608e542017fd7d

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 01:13

Target

ab5ab21678c7895f9375778f52798888d06ed9e35a021c53c3608e542017fd7d.dll
Size

6KB
MD5

656fb2068aa386e368ba5dd5b52389f7
SHA1

d7037e63929e7bc5850ac415781092133b41ea14
SHA256

ab5ab21678c7895f9375778f52798888d06ed9e35a021c53c3608e542017fd7d
SHA512

4797e0aa60cf97f2d2f8ec0bc544e325f12b62422a4c73dafac03cb4c922b9f3fc4383f754c4b9adec1c0e81a83a03865da98abf8b207701e2c3c5f3109971e6
SSDEEP

96:nEY2RrF1eqwi4VMMMuRRRGLMF+X9BrTGvpOCr5I2p7iJ:EHRh1eppVMMMuRRRGLMI2p7iJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28
PID 1908 wrote to memory of 1052	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab5ab21678c7895f9375778f52798888d06ed9e35a021c53c3608e542017fd7d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab5ab21678c7895f9375778f52798888d06ed9e35a021c53c3608e542017fd7d.dll,#1
  2⤵
  PID:1052