6bdb28795ba0411836838e0777e7e2a0a79f5998af96f5c2c0cc02af40a97f52

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:49

Target

6bdb28795ba0411836838e0777e7e2a0a79f5998af96f5c2c0cc02af40a97f52.dll
Size

327KB
MD5

7feb511325536c2d9fa391ba22a33e46
SHA1

f1a9d45c4bfbf4c10dd8728cea0ef2b0e39484e8
SHA256

6bdb28795ba0411836838e0777e7e2a0a79f5998af96f5c2c0cc02af40a97f52
SHA512

382fe1aaf379e5931febc218e11b4e99ec10fe0011071e802d6ad3cb602d30fc211d3ea45f7b3b2855b3e757aedd1a1d45e2d57962556f9f98e51a3542e169d5
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 2332	1276	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bdb28795ba0411836838e0777e7e2a0a79f5998af96f5c2c0cc02af40a97f52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6bdb28795ba0411836838e0777e7e2a0a79f5998af96f5c2c0cc02af40a97f52.dll,#1
2⤵
PID:2332