d3bd59ed0357e488813b406bb0d7485a4ea965269127d2c7516e4ea597aeff61

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 03:29

Target

d3bd59ed0357e488813b406bb0d7485a4ea965269127d2c7516e4ea597aeff61.dll
Size

315KB
MD5

b9f46dd07529802b9089fec0d8bbb186
SHA1

7824e2c0c1ff19a205b5af6c8868e2d00da0271d
SHA256

d3bd59ed0357e488813b406bb0d7485a4ea965269127d2c7516e4ea597aeff61
SHA512

2316a143ed29707740a2e7d8fba09914c88b1db724d0a3bf0e69dda4120f6ac01825f4eb6dded89c31b12cf23b99881dcd10e47884734ffc298928f322d22686
SSDEEP

6144:BmW5jDcGKxtzYf/uud9gEyUxmWtLMpwaTGm8u8zd2eDO3eKGUIGASsiHYK:BmWhDcGKxtbUxWpwaTr8ZdDO3KULASsi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28
PID 756 wrote to memory of 2336	756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3bd59ed0357e488813b406bb0d7485a4ea965269127d2c7516e4ea597aeff61.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3bd59ed0357e488813b406bb0d7485a4ea965269127d2c7516e4ea597aeff61.dll,#1
  2⤵
  PID:2336