b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 02:16 UTC

Target

b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3.dll
Size

442KB
MD5

4fb1b32bdef4796f48259f8a99f7a85b
SHA1

1a37b53b4a0a316ea657f699b61ff0063487983f
SHA256

b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3
SHA512

06766085cd7befe095804718398414323804e431158caf0777d8125ef3e63027bba47a80362db16830343ce32014909e92ca9dd2a534ea219f6aaf6075591201
SSDEEP

6144:4BqrTExMbwTmaI1gWzShM/EhZi5mdCavkHsqrqseBbm13fvqWBV+UdvrEFp7hKO:WqrQO2/C1CYEhQ5frq1VmRBjvrEH7F

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28
PID 1992 wrote to memory of 1632	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3.dll,#1
  2⤵
  PID:1632