9ca3422b8edc2ab039265051a3e3a3354de482b5007e52a007fc1d05ac445e20

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:02

Target

9ca3422b8edc2ab039265051a3e3a3354de482b5007e52a007fc1d05ac445e20.dll
Size

327KB
MD5

06e40ad22e640be8c71e2be5883d7d3c
SHA1

a8ae68b1932572e14f26b5e18e2baa4ead90fbe7
SHA256

9ca3422b8edc2ab039265051a3e3a3354de482b5007e52a007fc1d05ac445e20
SHA512

70c738d8f0a14589f495fda22dc15f8b2519ccf5c2df0add9a2de4a7036d95acfa8b0a25263e9897afe0cb31a43b463040a266797b92cc0481c237fd9442a508
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 2100	3020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca3422b8edc2ab039265051a3e3a3354de482b5007e52a007fc1d05ac445e20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ca3422b8edc2ab039265051a3e3a3354de482b5007e52a007fc1d05ac445e20.dll,#1
2⤵
PID:2100