5037d9ce7471f306fd1c699fdde10db0587345e3b4bc4e59a7c8a6979749a579

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 21:10

Target

5037d9ce7471f306fd1c699fdde10db0587345e3b4bc4e59a7c8a6979749a579.dll
Size

131KB
MD5

6247bdfb95c161ed2e86648baceff4af
SHA1

19dc92abab20c3aab6b29eb111662a72b6ba8a2b
SHA256

5037d9ce7471f306fd1c699fdde10db0587345e3b4bc4e59a7c8a6979749a579
SHA512

2c57d8ed55c028b439a9863eb8a760a0e7ba9855c151a2e521e4e4e63e201929d00f8a051cc2f650777655caa6e639deebb10eb9a17d6061473d08bd1d7673cb
SSDEEP

3072:LokPB5JzP6mJGaZqnWLV7uS4EkHNZFjXlWX13/qOYO:pP5j6kCWLv4EyfW/SO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28
PID 2172 wrote to memory of 2348	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5037d9ce7471f306fd1c699fdde10db0587345e3b4bc4e59a7c8a6979749a579.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5037d9ce7471f306fd1c699fdde10db0587345e3b4bc4e59a7c8a6979749a579.dll,#1
  2⤵
  PID:2348