9c6f08d9c191d3a2a05059d9d877d7bd58825d842f3e45948fa5fbad7d4df3f7

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:19

Target

9c6f08d9c191d3a2a05059d9d877d7bd58825d842f3e45948fa5fbad7d4df3f7.dll
Size

138KB
MD5

17197140b7b52bb84400f8e6113e92e2
SHA1

295f4aa8276ddd8348b29a0d15e0c05d3fb12fa4
SHA256

9c6f08d9c191d3a2a05059d9d877d7bd58825d842f3e45948fa5fbad7d4df3f7
SHA512

be413513fce523ce4da9f72f1c1bf76873fd754c7e062dfe2b9e2df028b3b4a2e1f50a8f370d9867b6370d8513dc02ee3d4161291baf34c0428134342b3e770d
SSDEEP

3072:0WhmPs6TzvmuT90x+0iB3RUN4AIFJQ+2B5yOfn2:0ZRTzeskx3y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28
PID 2140 wrote to memory of 2604	2140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c6f08d9c191d3a2a05059d9d877d7bd58825d842f3e45948fa5fbad7d4df3f7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c6f08d9c191d3a2a05059d9d877d7bd58825d842f3e45948fa5fbad7d4df3f7.dll,#1
  2⤵
  PID:2604