fcadf0a0a2c90421f3b2b67f4649eabec2d0c8d4dda9127c7621de4ae052f09d

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 02:06

Target

SoftwareLog.dll
Size

525KB
MD5

1ba27e4cb5ef7cbd6e7030d594d55c3e
SHA1

f12f86cd47e56ef8e11ca4cc09f1f359afc2df1f
SHA256

72e815797d5f7ddb56066cee4feb04115ea210baa196575a7d3284fc83055078
SHA512

35e0e6f693b6cb46ed143673c1d4a0b7bf11787f546c023130b7abb92de47c53de6f0bcb05eb5d8f232d0abe3a559926d5d25475bd029d59227087aff849ad94
SSDEEP

6144:QSyOKYyPDaiLRvrww2KQaDKgqhk1sGYs/05QGbaLq0FEHoAld0hqZ:HKrbNvcw2uDK5k1sJs0QI5TIe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 3048	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SoftwareLog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SoftwareLog.dll,#1
2⤵
PID:3048

memory/3048-0-0x0000000074E60000-0x0000000074F18000-memory.dmp

Filesize
736KB

Download
memory/3048-1-0x0000000074DA0000-0x0000000074E58000-memory.dmp

Filesize
736KB

Download
memory/3048-3-0x0000000074E60000-0x0000000074F18000-memory.dmp

Filesize
736KB

Download
memory/3048-2-0x0000000074E60000-0x0000000074EE0000-memory.dmp

Filesize
512KB

Download
memory/3048-4-0x0000000074E60000-0x0000000074F18000-memory.dmp

Filesize
736KB

Download