57113bdc0d92b36f99b864de2cfff84df837ea9b23fe2592e23e6e11345ffacc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 23:24

Target

57113bdc0d92b36f99b864de2cfff84df837ea9b23fe2592e23e6e11345ffacc.dll
Size

6KB
MD5

791e3df0f2414d454b06a7e9219e3750
SHA1

822891458825fa8f321521e747e7025d1e50e1a3
SHA256

57113bdc0d92b36f99b864de2cfff84df837ea9b23fe2592e23e6e11345ffacc
SHA512

aa7be61711b399783634e069f7f8fdc6a86c38bc483d5396abe0b60d0f979f8ed7eaf6ad551426aa8774a83db8c203a07d75bf9c4ad683d2bb2c044d7faa4b24
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU107B+BDq9J5SV3DY:CSVVEPozmB7NB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28
PID 2196 wrote to memory of 2808	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57113bdc0d92b36f99b864de2cfff84df837ea9b23fe2592e23e6e11345ffacc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57113bdc0d92b36f99b864de2cfff84df837ea9b23fe2592e23e6e11345ffacc.dll,#1
  2⤵
  PID:2808