41385952de351d2d9f49aefe876e65fe32798ba1d0952d3072747b9c1364294c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:34

Target

41385952de351d2d9f49aefe876e65fe32798ba1d0952d3072747b9c1364294c.dll
Size

244KB
MD5

8e993c88ef560d99f5b9b19cd29b4140
SHA1

b97e0420995a32f61fc543a354fb3ccce28fe0ce
SHA256

41385952de351d2d9f49aefe876e65fe32798ba1d0952d3072747b9c1364294c
SHA512

15afd0da983109fdfcce47d3bc372c67cc5687f8495b08e291e1aa1a6e46ff0260b4e0a3b50b8e2ce2238be9db161212e67b3e377f489fdfa07c11f927b302ae
SSDEEP

6144:l8a2IqKOTO6pi1UzM3khdkfTPZPtj3L5:SSqKilpi1gfmtl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 1176	3028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41385952de351d2d9f49aefe876e65fe32798ba1d0952d3072747b9c1364294c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41385952de351d2d9f49aefe876e65fe32798ba1d0952d3072747b9c1364294c.dll,#1
  2⤵
  PID:1176