016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:18

Target

016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d.dll
Size

1.1MB
MD5

f664e772632b3ff3121f22c4d6a253a4
SHA1

d89619139d98a89b8f9c3b1cfb942d126d583e88
SHA256

016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d
SHA512

764d862a885d09bf4850888010b9123695bef16b2d1c752fdf98950e9cf4112a721eaf84fc141ff277c893408cf5a544501d00e2dd1aacec46798abb9745843b
SSDEEP

24576:7kD9IKoDUuI8xDNkJ79vro8h+huO3IMJKEC89:H7/80oO4MJKu9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28
PID 2504 wrote to memory of 2908	2504	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d.dll,#1
  2⤵
  PID:2908

memory/2908-0-0x0000000000940000-0x0000000000A56000-memory.dmp

Filesize
1.1MB

Download
memory/2908-1-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2908-2-0x0000000000940000-0x0000000000A56000-memory.dmp

Filesize
1.1MB

Download