388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:51

Target

388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f.dll
Size

6KB
MD5

0e84d346df16dfa0d32fdfd8f0d5b540
SHA1

9c074776db000f018977e10384c71efa07578341
SHA256

388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f
SHA512

918483553b67afe4ef660e1c61f09d6902160b278b94113fcfd269844ed7b94d7b05a0be2b08d56b900d6507ce4572ea03891a4aa9a3d9b8aba5977ad044b5f3
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G03mB+BDq9J5S2:0QDV8FscMjsLFV3PmB+FqX5S2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2816	1460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\388cab05e7c54ef878b068b7e5970789fad3c24ff53af094a2d81048dd37e45f.dll,#1
  2⤵
  PID:2816