b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:19

Target

b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1.dll
Size

327KB
MD5

68c244a3021cb7a712efcb0c31d92ec8
SHA1

e2129517bc3af56b6d8883099328ab4d2b6a421a
SHA256

b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1
SHA512

991bf4411ea36fef1fe89e1385822184787028aa297cebe31dc1bb330c8c478e1a7957dcd848fa84d9124bb0334f82d47fbebbe858b928089d2e46e0bf9a0318
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe
PID 2552 wrote to memory of 2748	2552	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92f4f7aa008f7552fc9eeb42c096c8ab092543273238fdef47887fdee3fdaa1.dll,#1
2⤵
PID:2748