38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:21

Target

38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637.dll
Size

8.4MB
MD5

613c4362904eff8d7c3c52e762d755d8
SHA1

15f4139a67d71567facda192399c8b933bf7e4bf
SHA256

38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637
SHA512

dc61ecc0e18d63b8772cf93e4bc8c32f8ce8b8639afec21f8e9b09f98370c76740ba35ae5c4d984510bb1c72fa882d21aed336a0b7d87a6889fbbaba10f08f7b
SSDEEP

196608:NVw7qVycDcqSCl1DbgLrFYDPeOUNLQCGP9lcclsYkL:bw7UKqSCl1DbgLrFYDPeOUNLQCGP9lc1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 2212	1924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c381e1f0d8db27082d5809b70fc73d5c7137e266bc22b4301dd4bbd5e79637.dll,#1
2⤵
PID:2212