f6f4951f98185ba8ddcdaa43f13b8106b9b667bb7f5ee027dc51b4bca4556adc

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 05:47

Target

crtdll.dll
Size

145KB
MD5

d17a0d5e0b6f95bb133c6dd761ee78fd
SHA1

4c324fb8b01033b743a115c242a11e8c827522c4
SHA256

f6f4951f98185ba8ddcdaa43f13b8106b9b667bb7f5ee027dc51b4bca4556adc
SHA512

ce4619c6da49b6f6c098346efdff6bb176cb07ba436591844ade601e2d9f4dae81eec881992f0eb18816402a59f52a117cc37d41288825e371b9d6bf6df56d13
SSDEEP

3072:10G/tFLKTkoRUcrDFGRheXGoG5ohUfzQn+B+kZ/ALzywU1OoOQob6e8NB18ams:CiFLKTkomcrDqnomoyfPB+kZ/ALzyXyy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crtdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\crtdll.dll,#1
  2⤵
  PID:3024