f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 05:09

Target

f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7.dll
Size

81KB
MD5

94942528e4fe87e59268bb70cd2d1a49
SHA1

a5fed2cd750453cc21d340362ce1cb05a31e9f39
SHA256

f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7
SHA512

ba1367aaab5b521e808fc0c4fbfcdbef232e0b10809adf7c5b8b28276b4a12dd23fa31354a5c6be2815faabd832b72721cc6ea36543d9d0c195a3df881261929
SSDEEP

1536:4ByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W+:lv4JKXTx71wnArSsXFpeXq8W+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f61f0a81b78abc6b809c49eb9c8708931c7f69080cddd13931e7256f2e0a8ba7.dll,#1
  2⤵
  PID:2172