40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:17

Target

40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66.dll
Size

81KB
MD5

c5a5275b4318b744d5b98b0f3b456956
SHA1

db097612091ef5d04b655fb1d06396e35a579377
SHA256

40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66
SHA512

d0b243be181e7a37818f13e24c1a6d4dbb34ac5195f37217f6248302f371e7029a135e486712db701bf634819eb7a3890ecb4194c7bedf267d8c540674feb112
SSDEEP

1536:VtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WU:V4v4JKXTx71w0ArSsXF3enq8WU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28
PID 2912 wrote to memory of 2704	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40220dc26902159df4419c59b8868a30e9f7b2cf436be15ca3d8b4b8ac56fc66.dll,#1
  2⤵
  PID:2704