58792b80054d3bfea4f581c75e90c46782911face761705741e0232fc740435d

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 21:39

Target

58792b80054d3bfea4f581c75e90c46782911face761705741e0232fc740435d.dll
Size

325KB
MD5

22728421e2075e364780800f259baac1
SHA1

f45b812628a701b5b8bb985c009bebee22c032d9
SHA256

58792b80054d3bfea4f581c75e90c46782911face761705741e0232fc740435d
SHA512

0159157580bad9853c52bec9b538ffb2eb337e819e1978c1497be1e8a08a782b68d9d2427093958e708c1b70fa61def330a3408c61620649e1b1ed9053cb3e04
SSDEEP

3072:K9e4DFo1EUNp/13MbNY12RE7BrLioVZw6/v/Okb+LpBBFa:K9e421EOp50a7Z3GNpFa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28
PID 2884 wrote to memory of 2600	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58792b80054d3bfea4f581c75e90c46782911face761705741e0232fc740435d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58792b80054d3bfea4f581c75e90c46782911face761705741e0232fc740435d.dll,#1
  2⤵
  PID:2600