400167d713b96bc6c43400f65983cf8e1b92dbc782251e65ed4781444cfcf422

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 22:36

Target

400167d713b96bc6c43400f65983cf8e1b92dbc782251e65ed4781444cfcf422.dll
Size

20KB
MD5

ae6ccb381192a0e59e3e68f2e56adf23
SHA1

0a60600f54d936363f22d93df86f0e68dda22797
SHA256

400167d713b96bc6c43400f65983cf8e1b92dbc782251e65ed4781444cfcf422
SHA512

8397bf3df17853a83f480a307aec431f7fc16e9ef8f912cb4f36d8c49830bf8d00828045472bd546c4389e06242455e74f5ade77d599c61189acc4f84705b017
SSDEEP

192:nEjvGtASUvZ6AOkQFubSHhczDwVKFjS7ZbTQpjAzV7gKRb5nkYzJzgqr1k:EKrQSkET2SJTQc7l9Mqh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28
PID 3016 wrote to memory of 2032	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\400167d713b96bc6c43400f65983cf8e1b92dbc782251e65ed4781444cfcf422.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\400167d713b96bc6c43400f65983cf8e1b92dbc782251e65ed4781444cfcf422.dll,#1
  2⤵
  PID:2032