d4e14853fc5c0d56768e5919ecaf1f25ab02ccd86a441caa7a19bf9e5095622a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 04:30

Target

d4e14853fc5c0d56768e5919ecaf1f25ab02ccd86a441caa7a19bf9e5095622a.dll
Size

172KB
MD5

fe1d3dd55c7139b9ae61640579d26ac9
SHA1

eb1cc91f6c9dadaac001d62be8b0c3093ac51e98
SHA256

d4e14853fc5c0d56768e5919ecaf1f25ab02ccd86a441caa7a19bf9e5095622a
SHA512

feddee1a05069e4859866639642a264b834ed5876816b18365c97d2b3c2b4aadf04c27352083d03aa210f0415ddaa9996bf5d94c319d4395c8c0d6efee60ec5a
SSDEEP

1536:VbQh51C9mJXUR1wgYici7d4MJg3HhNIfUFIKmi4:hlmB9i7d4wUHsfUtT4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4e14853fc5c0d56768e5919ecaf1f25ab02ccd86a441caa7a19bf9e5095622a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4e14853fc5c0d56768e5919ecaf1f25ab02ccd86a441caa7a19bf9e5095622a.dll,#1
  2⤵
  PID:2212

memory/2212-0-0x0000000000170000-0x00000000001A1000-memory.dmp

Filesize
196KB

Download