4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 22:46

Target

4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846.dll
Size

22KB
MD5

f0b1c6cfdccece3f639a1e9db1ecd1b0
SHA1

7f786ed651b000bb03f3cc8aba52b29147ead77d
SHA256

4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846
SHA512

a45b88ee9d5e81f2916c0565cb0e16260571147e5e9392342bf867644849d3080f5d720d5708d4b255aea9f6551554f00381a2fb0fb5d3389c67fb1c3a263c9c
SSDEEP

384:hM+ciDFcYdo+dsXo8LPhdxmGsQCvrouOpv:QiD+YqYgxLpdxdTv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fbf64347a564d3685baae923843bb52b2bb4f4aa173398b0847ba5336418846.dll,#1
  2⤵
  PID:2468