a9c993032898a4ed33aff16d6721df4eb75fa426c6d2f09d4c19c31dd4d9deef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 01:17

Target

a9c993032898a4ed33aff16d6721df4eb75fa426c6d2f09d4c19c31dd4d9deef.dll
Size

17KB
MD5

de5e591f61e4b7ae411f3b8637a8cb06
SHA1

9dcbd44495b4f7c051f3ecd92ac03b14de8af8c4
SHA256

a9c993032898a4ed33aff16d6721df4eb75fa426c6d2f09d4c19c31dd4d9deef
SHA512

cb52e9219d766b70ecd1c46f028b5a4185fc6ac00bce3e3a8a1d9bc4a6c9bfad6580364bb5bd99ca6b8f65da4eeda68e265e8e33af30d39a62bc274148b9ce00
SSDEEP

192:bmhZDx2b5TixN6WWhoTkN9w5j8d+yaW1v+oHqEvB7R1KZO+PcqDezNkInUwR:yhZdoASWx5g/+oHqEvB7KL0o/2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9c993032898a4ed33aff16d6721df4eb75fa426c6d2f09d4c19c31dd4d9deef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9c993032898a4ed33aff16d6721df4eb75fa426c6d2f09d4c19c31dd4d9deef.dll,#1
  2⤵
  PID:1508