c486b3ea362c122d2ac9507a474f0df7eed2ebcd4db060a6a5f0ee25a51285bb

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 15:59

Target

atl90.dll
Size

157KB
MD5

64eca1f64e4a988a6c5c93f3e5d66236
SHA1

06fd9138c430e7f2d390b9a58edf5d949f57057f
SHA256

ab93df816c284ac247b9087663bc449beb26e6f64d9f8a6be2efecafa7a9cedc
SHA512

9646af577aa1390747cc58806d5bba167f21d4e6a05a87ddf200f3e0d64ccc05f2c0155e4da4ef89b17eea5fac748be9e4d6d074945d0bd07ab2d19e0d5ff3e2
SSDEEP

3072:vwXa3XmwTrLJY+OW1U3RjYCVOGKqoQ0iTEz3Txt2ZSsRYL53Fei3RIB8HafOafai:vNXmwbJY+Ou41hVYqV0iTEzDqZSsRYj+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28
PID 2008 wrote to memory of 2404	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\atl90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\atl90.dll,#1
  2⤵
  PID:2404