c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/04/2024, 03:52

Target

c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll
Size

548KB
MD5

3182365a61692919f67a612dcfac1b24
SHA1

7e65586ee2c14b0ed864914d637a6682ff73b60b
SHA256

c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7
SHA512

bd701f61232ba158eed85610ce88bd960e775f35745e80d0f2a028e77927915f7410cc45fb20f70163ceff2181c8a8a9c0f292f0113c008ee17a13c9fd7cd98d
SSDEEP

6144:YltBsygUtAzpmWJqAiF+vAeDukzhQs1fjVcR/SnmFaB7aS7gtRHG4YSfvj7D5bN/:gttcPzhjZm3nNqmomAgiakjZQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99bf90cc90f29ff013f95eafde182395d2386235522514562ccc9cfdf4ebdc7.dll,#1
  2⤵
  PID:2888