399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Target

399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227.dll
Size

8KB
MD5

3623c3b3a037e2896be9c94da4017899
SHA1

419b2883c120473c3bb016a7ec630756ac481575
SHA256

399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227
SHA512

c40b16afdf34dea1a886f6c7e62dfa7df89228f1ba120010e5d5601032267489a113bed06d110282cd873843fab707711dfdcfc9cd95e0ba86e4ddbdc09c84ad
SSDEEP

192:rLxQpVUv5fK54GRtQN6f0CZz+wEZ8OZzv82yRDmWsGKJcp9VYY:rGVUZK54+ff0Cgwe9vclm0XVY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2212	3060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227.dll,#1
2⤵
PID:2212