abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:50

Target

abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99.dll
Size

81KB
MD5

bb6daaadb05c9f5e54983ee23f46be60
SHA1

49af0743e567b9cd42860d4f23ca0b4a85da0647
SHA256

abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99
SHA512

4c9002f0db7e11236e47b7147d8fb44be6b334a7396aaf662d717226326c4b04d45050b9b817de8c329993221ed4ee09aefae2b49dbe085980b939b2618a7c4d
SSDEEP

1536:dtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WC:d4v4JKXTx71w0ArSsXF3enq8WC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28
PID 2804 wrote to memory of 2036	2804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abd12ab5f2fbc86cc18f248f56c73eb4d8e0258c287170f2247c82515c70ec99.dll,#1
  2⤵
  PID:2036