23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 11:53

Target

WindowsBase.dll
Size

2.0MB
MD5

831dd8ef63eff10f1199830b71257157
SHA1

ab5d0444ae8ccb3383649686b857044c961c8c4c
SHA256

8645346985c06b23c62b69591c387d336dbfbcab17712c52ed29ca604f85df49
SHA512

2eb23f65a2e448e24734e48151649da88d4339ba900af4535c23f627a7a5d9dc6393b2579c84e906923a68b4f816e3d7dca29379673188ac2dfd0624c6f7a876
SSDEEP

24576:lpvm4FQWeE8SPvyPmuuWGOemGOa4QoAfjBvEp3+REhF4kHfq2DkHcM0We4rc6VRD:Xvm4ae7jBveOREz4agHK4pVRouSqz42

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28
PID 2436 wrote to memory of 2424	2436	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsBase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsBase.dll,#1
  2⤵
  PID:2424