b120884bd09be0742ad0f2fcc549d7243f045b28b933c63754f390f5ded94721

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 02:52

Target

b120884bd09be0742ad0f2fcc549d7243f045b28b933c63754f390f5ded94721.dll
Size

365KB
MD5

52e29ebaa04fa90671d4cd5d2c38c676
SHA1

da20b45e1d9d6f403c243d0224b44cb05de13231
SHA256

b120884bd09be0742ad0f2fcc549d7243f045b28b933c63754f390f5ded94721
SHA512

58e6a53e398bd6d7fdd043256b46c8bd03cccb9df84a9624e3036b6346aeaf40d3bec80e51c38568f22466289933a3eabf61a5733cc68de60135750bb378e3e0
SSDEEP

6144:oh/Q+NIR1ptBlZdxVJNhF59R1ptBlZdxVJNhF59R1ptBlZdxVJNhF59R1ptBlZdg:o6+NIR1ptBlZdxVJNhF59R1ptBlZdxVk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28
PID 2420 wrote to memory of 1004	2420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b120884bd09be0742ad0f2fcc549d7243f045b28b933c63754f390f5ded94721.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b120884bd09be0742ad0f2fcc549d7243f045b28b933c63754f390f5ded94721.dll,#1
  2⤵
  PID:1004

memory/1004-0-0x0000000000290000-0x00000000002F0000-memory.dmp

Filesize
384KB

Download