78cdeb931a41cc86ddd25d07a6ccefcaf53e754d61568e50826dcc7e36d8a124

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:33

Target

78cdeb931a41cc86ddd25d07a6ccefcaf53e754d61568e50826dcc7e36d8a124.dll
Size

981KB
MD5

bbf4c3a592e1dd0182539812f6e20de0
SHA1

4e9ee1cba2c21b20f1dbd11412e1dbebb75273b7
SHA256

78cdeb931a41cc86ddd25d07a6ccefcaf53e754d61568e50826dcc7e36d8a124
SHA512

cb694e8abbd9f579a7256c6dec3ad1ad471822a67029724e741c5af26a3e73e4f95ef84a11b484b6fee7e86150fddde13cee5fb911719f3c96cde8487109b4a2
SSDEEP

12288:oSs6hMVdswyJoexRfJFn3C0OHxhJhQrofDbZ:i6hZTJ5x1Ln3C0OHxhJgofD1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28
PID 1244 wrote to memory of 2212	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78cdeb931a41cc86ddd25d07a6ccefcaf53e754d61568e50826dcc7e36d8a124.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78cdeb931a41cc86ddd25d07a6ccefcaf53e754d61568e50826dcc7e36d8a124.dll,#1
  2⤵
  PID:2212