4e616b28f3b4a736ea610d193c5d16d7368b943ba910265e0a8111922775c4b0

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:39

Target

4e616b28f3b4a736ea610d193c5d16d7368b943ba910265e0a8111922775c4b0.dll
Size

185KB
MD5

e4a803e7584f7c2482f7420f15bde0e0
SHA1

3cf411e30a2c1726b9a7fd5574daed98eba6235c
SHA256

4e616b28f3b4a736ea610d193c5d16d7368b943ba910265e0a8111922775c4b0
SHA512

6df8a174ed5f2d981d679d20c93e58afb379e32e5c5a9d9805d45e84998a0990338098a4a44a8935e86812c6b30115b75ed1079269833cc5dd9cb47d4f4cd9d4
SSDEEP

3072:fM017rPGHIToAj7wo/DUXw2f+QKRdfHjz17:p9wIMAjUADzLB7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 1632	2992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e616b28f3b4a736ea610d193c5d16d7368b943ba910265e0a8111922775c4b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e616b28f3b4a736ea610d193c5d16d7368b943ba910265e0a8111922775c4b0.dll,#1
2⤵
PID:1632

memory/1632-0-0x00000000001F0000-0x000000000026C000-memory.dmp

Filesize
496KB

Download
memory/1632-1-0x00000000001F0000-0x000000000026C000-memory.dmp

Filesize
496KB

Download
memory/1632-2-0x00000000001F0000-0x000000000026C000-memory.dmp

Filesize
496KB

Download
memory/1632-6-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1632-5-0x0000000000269000-0x000000000026A000-memory.dmp

Filesize
4KB

Download
memory/1632-4-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1632-3-0x00000000001F0000-0x000000000026C000-memory.dmp

Filesize
496KB

Download