24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 08:01

Target

24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a.dll
Size

6KB
MD5

8921554d0d0beca9ede18f4228a7f460
SHA1

054d311a79692d3adf4814325bb6e82767e47f5d
SHA256

24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a
SHA512

6c3a3dac0f21e240e82645c676ec49a5ef04e93d515e8250fb2ae2cde7e279ae0d7b41bfeee0b365960353f401826ae4f7ab08d34457eaff6648f7c7a5daa6b0
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0GB+BDq9J5SH:VDa9VUX9bQWmB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28
PID 1284 wrote to memory of 2056	1284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\24aa9a17c22981335e1830dbd3e33cd50c0a8f17294c259b9b6b587b3f866f4a.dll,#1
  2⤵
  PID:2056