9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:43

Target

FileHash.dll
Size

531KB
MD5

2480394be8834caedf2040b240d225ea
SHA1

a5d4c485acf74a591a5e1d41e8f18e4b693f8db1
SHA256

ad0b9e5bf3feb17f41828323061472510ff726e4989ec7d547e4e91a7cf3fa4b
SHA512

00182d306fe8feeaacbc7c2dcbcce81dac3e518c2be77c4cef780bea31c133877fde6544124a2bb993c9865115b6034c2ba9ad037e57e46c47b22d310443dc8a
SSDEEP

6144:Or0P4W0zK8sKD2GbjEQ3ypNmUcTyMQ1biaA1+vlXhzYvbQRUncK4aPVLxS4PYbY:CvmhobjEQ4NmIV1uP1izQZfBCY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 1512	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FileHash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FileHash.dll,#1
  2⤵
  PID:1512

memory/1512-0-0x0000000074DD0000-0x0000000074E89000-memory.dmp

Filesize
740KB

Download
memory/1512-1-0x0000000074D10000-0x0000000074DC9000-memory.dmp

Filesize
740KB

Download
memory/1512-2-0x0000000074D00000-0x0000000074DB9000-memory.dmp

Filesize
740KB

Download