66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:39

Target

66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d.dll
Size

327KB
MD5

58534dca4ddf8cfd0fdd0e52bc9842f3
SHA1

dde2b5579677c85d1ccdf308a8b19e59bbd6e74d
SHA256

66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d
SHA512

e53c509d4bae1ee26b02d2239dbee543665fdb6a276f83b0e53577f53594f16a122ef7770cffa14187b815c856f0baefe378c24e66a33ebfa49efc3595fe9886
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4AISs9Ei:EmWhND9yJz+b1FcMLmp2ATlSsd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe
PID 2068 wrote to memory of 1892	2068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66cddbc1b7989250865ebbb704651c595c7ba5417fd8b21b17aa3b0649cd348d.dll,#1
2⤵
PID:1892