f2afc1c804c8acd3b89d2a5335a41e1cd6ecd18e75129649e57a103eb548eb4d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 04:14

Target

f2afc1c804c8acd3b89d2a5335a41e1cd6ecd18e75129649e57a103eb548eb4d.dll
Size

6KB
MD5

5a2bca0be8af7188d626bc6bbc5ac80e
SHA1

f7752f554790cacd735cc2cc8139c7cc648cc3c4
SHA256

f2afc1c804c8acd3b89d2a5335a41e1cd6ecd18e75129649e57a103eb548eb4d
SHA512

e91b7f0056c725d11e63a8271bd1f7de2bd83550e43fc7d06d21eda242243b4a204a0714817e3adeb2319fa9a3267c388c6e06b174d432db7428f050a1833673
SSDEEP

96:hy859x0P8Ma4DjZHIUe9bYfGVp6eZLiMg80/mxwHlJan1:F5oL51IxbmGnDkMgexQlW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28
PID 1944 wrote to memory of 2352	1944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2afc1c804c8acd3b89d2a5335a41e1cd6ecd18e75129649e57a103eb548eb4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2afc1c804c8acd3b89d2a5335a41e1cd6ecd18e75129649e57a103eb548eb4d.dll,#1
  2⤵
  PID:2352