e2f2ec9d680a6d3630bf7e2dd223836b5c4fdba8b95249047445f2469c005174

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 04:30

Target

e2f2ec9d680a6d3630bf7e2dd223836b5c4fdba8b95249047445f2469c005174.dll
Size

81KB
MD5

cc95ce85b608a08baaca154503a6739e
SHA1

35061db16c2accf7bb4262635a75fbb7d8307d6b
SHA256

e2f2ec9d680a6d3630bf7e2dd223836b5c4fdba8b95249047445f2469c005174
SHA512

63f9a0adb793c1a98f1e807d0409a068d206e7f23ceacc6dd462254e755efaa9be2cbbe76af865a9d9f578d2fa8e68eb2f02b67f257fd56df08df948f6cd7059
SSDEEP

1536:utByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W7:u4v4JKXTx71w0ArSsXF3enq8W7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28
PID 2368 wrote to memory of 2700	2368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2f2ec9d680a6d3630bf7e2dd223836b5c4fdba8b95249047445f2469c005174.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2f2ec9d680a6d3630bf7e2dd223836b5c4fdba8b95249047445f2469c005174.dll,#1
  2⤵
  PID:2700