3402591b2f9ba1c9ac12a6c178b9cffeed5442c660c1707b2d8c532d9e60aa8d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 20:24

Target

3402591b2f9ba1c9ac12a6c178b9cffeed5442c660c1707b2d8c532d9e60aa8d.dll
Size

327KB
MD5

0c9452f1f13ca4566ba797a5a262d5f2
SHA1

19ed553a4ef4bd03e432939357eb631a6c336ed9
SHA256

3402591b2f9ba1c9ac12a6c178b9cffeed5442c660c1707b2d8c532d9e60aa8d
SHA512

d8e881cb469c3a31cee20bb25b57d1ea7cbc63fcbdb5281178c9b2d949a9299155a1041d287fe395ef4ac98b6cab18f75e6eee19d600a63d58f6d931886e27d5
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28
PID 2080 wrote to memory of 1956	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3402591b2f9ba1c9ac12a6c178b9cffeed5442c660c1707b2d8c532d9e60aa8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3402591b2f9ba1c9ac12a6c178b9cffeed5442c660c1707b2d8c532d9e60aa8d.dll,#1
  2⤵
  PID:1956