4e5c014ee6f5731909bc8b9fbfdc65e8c749d6f170cd7bea25cd313da9d3ac94

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 21:56

Target

4e5c014ee6f5731909bc8b9fbfdc65e8c749d6f170cd7bea25cd313da9d3ac94.dll
Size

6KB
MD5

71c7980467bf0ca8c45f390569b56e22
SHA1

58267c132f23faaf4b9fa3a82932f43242a1ef2c
SHA256

4e5c014ee6f5731909bc8b9fbfdc65e8c749d6f170cd7bea25cd313da9d3ac94
SHA512

08178579ce12a5a3e8466a1ad1b4e5c272d7c2462b582e211bffcb04da06e7f2584b87c9721bbeab705208363999d9e400df28a95217c2d93f6cc12996f28169
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIE8+iNq5zNCVBN9JWmKPYMra2:unSR6bgY++KQNC7skM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28
PID 2140 wrote to memory of 2912	2140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e5c014ee6f5731909bc8b9fbfdc65e8c749d6f170cd7bea25cd313da9d3ac94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e5c014ee6f5731909bc8b9fbfdc65e8c749d6f170cd7bea25cd313da9d3ac94.dll,#1
  2⤵
  PID:2912