efc37f9067696e7e299b598529f9ec84a952b90f338742198afa72ee20bb53be

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 20:59

Target

efc37f9067696e7e299b598529f9ec84a952b90f338742198afa72ee20bb53be.dll
Size

1.3MB
MD5

f1edc38c347ac5da5bc207db9973e69f
SHA1

69136689a004b9085ab440164134483c2aff2e0e
SHA256

efc37f9067696e7e299b598529f9ec84a952b90f338742198afa72ee20bb53be
SHA512

a12437a9136925719b7342039b97cb95f76afed9fcf282382c2e2baade55409e8423e70ea50b92e5fc24df60fe2c4d6698d1a117e3ffc62363612fc80ee87ea2
SSDEEP

24576:etEvwEGpw2yeYJDr3JVbDznC+TspIrvG3Es:twJyeYJrTC+TA8E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\efc37f9067696e7e299b598529f9ec84a952b90f338742198afa72ee20bb53be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\efc37f9067696e7e299b598529f9ec84a952b90f338742198afa72ee20bb53be.dll,#1
  2⤵
  PID:2192