e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 01:39

Target

e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a.dll
Size

143KB
MD5

786756c0ea8c6b146e336f662bef1a9d
SHA1

43ebde827896e9281da7ebaf43205b8fc11fd197
SHA256

e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a
SHA512

aaaae6653e170dd81f5686097c6327c210454c6f39a1f200f648a74515744a8b21551eb01cfbcb18ea8ddca3722800f49f82183b4ea65e8921f4042d66291417
SSDEEP

3072:3GYcR19KDICARggR26KKnY2B7SAzCgCMKdYjtvKu:wfKsRKIYYuhdY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28
PID 2204 wrote to memory of 2956	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e444558a435731f5531467a9cca0c2861d230ea79d924cd370460fef8be9f02a.dll,#1
  2⤵
  PID:2956

memory/2956-0-0x0000000000EE0000-0x0000000000F20000-memory.dmp

Filesize
256KB

Download
memory/2956-1-0x0000000000710000-0x000000000073C000-memory.dmp

Filesize
176KB

Download
memory/2956-2-0x0000000074DD0000-0x0000000074DFC000-memory.dmp

Filesize
176KB

Download
memory/2956-3-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download