28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 20:09

Target

28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956.dll
Size

31KB
MD5

81aba15e157845175a226611b136ee07
SHA1

6a18f8c51c772861fd9ffb59767511207b4b5a4a
SHA256

28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956
SHA512

481515e03b557b74daf888592257712c42cf8d88804cdc6001417c5245744454772ece6dd47ae196cf0098a84df3ca93aad045aa9a7dd13c33e66df1e4568979
SSDEEP

384:mbpd8ffVLqN/otX+1agZOboPIRgB+eeMU6VATveq7ELTZaz3NzpIvGD1:PqNsYYbOVATvLseD1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28
PID 1704 wrote to memory of 1432	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28cffe4cdd7d620d5ac62ff729e9ca19ae211f86df762aa497bf96a5a3dc4956.dll,#1
  2⤵
  PID:1432