020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 18:09

Target

020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll
Size

168KB
MD5

12a7dcb3056ec47f82a6571ae2f401b6
SHA1

661bd039fe812723adb21f36e582b5cf0272f3e7
SHA256

020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9
SHA512

5a21b8706372df3fc6b7bcba823b82c7ff89ad6d5f2dd51ecebf25dcd68f8ac7667f8fdd8e5c08334f1c082a3f088a8aee4050ac7aad1a9dbde7fc63beacb03c
SSDEEP

3072:mnL5U9mOXm6Tw1zwk1LFAkA1cMco9wYfScAoZ:sUHTwVwkPALHWq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28
PID 2856 wrote to memory of 2056	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\020b0ba24699f968605a18214de1e2b4a8f8c3b6a33d488ef07b1408f7ba11b9.dll,#1
  2⤵
  PID:2056