aeda0ca858ca92774e7223d6fb28ee7b87c5bc10ef2a3aa20eeb758fda969371

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 01:22

Target

aeda0ca858ca92774e7223d6fb28ee7b87c5bc10ef2a3aa20eeb758fda969371.dll
Size

6KB
MD5

3d681714d06ab01e3e36acc24d2dc444
SHA1

599e58026a7fcc958e1b52b99b04a5aa1429d379
SHA256

aeda0ca858ca92774e7223d6fb28ee7b87c5bc10ef2a3aa20eeb758fda969371
SHA512

67aba9ba3a0752bdc92393339c017d7a70100a58b0791367bd017744d7bd96325c27fa114c678833875475cf6632196e713e3c24f52473814e7912587ede6342
SSDEEP

96:hy859x0P8Ma6xz5CPvS4sg3D/vry39W+uIs/2WykRG/GBr:F5oL3x8vXDXrE9W/MkR2S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28
PID 2148 wrote to memory of 3048	2148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aeda0ca858ca92774e7223d6fb28ee7b87c5bc10ef2a3aa20eeb758fda969371.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aeda0ca858ca92774e7223d6fb28ee7b87c5bc10ef2a3aa20eeb758fda969371.dll,#1
  2⤵
  PID:3048