20a482d03485031a84636bc19152f63564cd2bc3eb10be1023c2e51126686106

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:13

Target

Modules/cus.dll
Size

102KB
MD5

afebf92fe3ceb4ad86cb806d6aaa0d7d
SHA1

1d9e7c4b8c1d938bca48dbb8edb53b6f34522ee4
SHA256

efa1abf8a7d331681a20739e362f8a0faec2fb8f8bcc7a7f2e4ba76147fbf4a5
SHA512

8c910f690f97200203fc4820d19a70bd51afc5e3bebeafe3107453eb6bc71166b152b3bb2f82586d3e06b9930a1be12daf43434ab763087792e3e468d563b581
SSDEEP

1536:J7PSVQhAoTtwAjjk2Ve9z7BvFjuJfCv6+LSEYxQcetvch89lVsmU79tjHOCshOi0:JD+807BvFjuJWVVY9ICshOIbZDa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 356	1940	rundll32.exe	28
PID 1940 wrote to memory of 356	1940	rundll32.exe	28
PID 1940 wrote to memory of 356	1940	rundll32.exe	28
PID 1940 wrote to memory of 356	1940	rundll32.exe	28
PID 1940 wrote to memory of 356	1940	rundll32.exe	28
PID 1940 wrote to memory of 356	1940	rundll32.exe	28
PID 1940 wrote to memory of 356	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\cus.dll,#1
  2⤵
  PID:356