a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 01:32

Target

a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf.dll
Size

303KB
MD5

63d64e58014dec0a357a27fad75a79ed
SHA1

8e9483a9f91e1911a0db19167b7741a823da5746
SHA256

a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf
SHA512

753babe2e87418d571639ffb1935a75fd12c1e6f8ffb4e914d8bdbf7ac94c2db00ac52ddac6eb466de7d0e23a6a283aa35bf1092b9f0046214c41d352c8b2278
SSDEEP

6144:MibiBWGNdVlqXzcU0ibHozAPQqoGvRo/FkS:MibiBdLqXzl09StoH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28
PID 1924 wrote to memory of 2472	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a994fed02d65406dc61ef3a84bdbd1368b5a3d20b28f5e9c391adc64ef87f8bf.dll,#1
  2⤵
  PID:2472