21790974e021aa160dfb3ebfee9803775b2d2aa6c5f6abfea22b07af097407dc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 19:29

Target

21790974e021aa160dfb3ebfee9803775b2d2aa6c5f6abfea22b07af097407dc.dll
Size

96KB
MD5

647fbde283ee564e9eb88c94890a742f
SHA1

5ef805eb823b78b33db8c45afbce7160735ac541
SHA256

21790974e021aa160dfb3ebfee9803775b2d2aa6c5f6abfea22b07af097407dc
SHA512

39b4b7d6a4bb231a84e2e909a9ddc69db84fc13f46fedba36f5ed836fece1f9bf96763d470b6156fe8e7786b1ecda4855046d3b39f5fa10537cab30e678e8f57
SSDEEP

1536:Tj9D65gM7ytc2BqbehiKi9LSn5MSM+7fG7qABH00h/dZWPcntc+b1JD:VgX7y3mehNi4n5MSjfCbvkctcE1Z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21790974e021aa160dfb3ebfee9803775b2d2aa6c5f6abfea22b07af097407dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21790974e021aa160dfb3ebfee9803775b2d2aa6c5f6abfea22b07af097407dc.dll,#1
  2⤵
  PID:1888