94e5217a9f80840e0ca6e7404e3e0ebb81805dcc0bf6217cf9cd3943a6bc545f

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 22:06

Target

94e5217a9f80840e0ca6e7404e3e0ebb81805dcc0bf6217cf9cd3943a6bc545f.dll
Size

81KB
MD5

ad2ec3a76cd57cca00f3f08feae582f0
SHA1

082eb2ee05059394943c2d30f6ad1aa84765e8a3
SHA256

94e5217a9f80840e0ca6e7404e3e0ebb81805dcc0bf6217cf9cd3943a6bc545f
SHA512

c2c24bdbff8b132e941eb7100cb463433d8931ed7bd2e5b45ea940743a80c61cf93e3a5ba6dcac9740d8a00d618225a0948e0264a1a335e535b66fea01b4dbdb
SSDEEP

1536:ktByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W4:k4v4JKXTx71w0ArSsXF3enq8W4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94e5217a9f80840e0ca6e7404e3e0ebb81805dcc0bf6217cf9cd3943a6bc545f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94e5217a9f80840e0ca6e7404e3e0ebb81805dcc0bf6217cf9cd3943a6bc545f.dll,#1
  2⤵
  PID:1740