f8f1137035ff5055adb09094075ebe080037cbf44ae627a0fb223cf6ed87e136

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 06:20

Target

f8f1137035ff5055adb09094075ebe080037cbf44ae627a0fb223cf6ed87e136.dll
Size

45KB
MD5

70f7af4fc35102560fb7980b59ebb4fb
SHA1

fb88028fc13424aff84c8e1f90a2b37966117946
SHA256

f8f1137035ff5055adb09094075ebe080037cbf44ae627a0fb223cf6ed87e136
SHA512

67f07a9442ed310d4f4712a5618dbe6e850b0845cb354327522e0d455e24523ab2a910b23fa7d573af3145cf75ada6f8eb9c5e7246e29cde1560543106acb6dd
SSDEEP

384:YHD3nc9eHz0CwTmDq092XSDGdhv9+/hHADGj9+/7Zfh6:iLckHz05TmDq091DGdhMhgDG47Zfh6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28
PID 2272 wrote to memory of 1544	2272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f1137035ff5055adb09094075ebe080037cbf44ae627a0fb223cf6ed87e136.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8f1137035ff5055adb09094075ebe080037cbf44ae627a0fb223cf6ed87e136.dll,#1
  2⤵
  PID:1544