88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 14:07

Target

88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4.dll
Size

112KB
MD5

57aa4d5beb0302fdb315551e6b091896
SHA1

0c917a227fe749a44bc3e44bc1224a2ac95909e3
SHA256

88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4
SHA512

28b62200a5889a67cc844400fda320b447e780df19a8b492d1b49f04871f54cf029ef3dd51d961f5102ac39123da59c0f01f9b26bfa11cad6fac91d723770e40
SSDEEP

3072:X0y9PkXOCx1G9Iqni8FWxqeiprBhkekg+1/1OxUmf2O5:XL9MXOhhFLlcgG1VLO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\88469c8a2cb83c1d49440b0cd7507d6f2dfaefac586044f73a42e34e02934cd4.dll,#1
  2⤵
  PID:2164

memory/2164-0-0x0000000075140000-0x00000000751B8000-memory.dmp

Filesize
480KB

Download
memory/2164-1-0x0000000075150000-0x00000000751C8000-memory.dmp

Filesize
480KB

Download
memory/2164-2-0x00000000750D0000-0x0000000075148000-memory.dmp

Filesize
480KB

Download
memory/2164-3-0x0000000075150000-0x00000000751C8000-memory.dmp

Filesize
480KB

Download
memory/2164-4-0x00000000751C2000-0x00000000751C3000-memory.dmp

Filesize
4KB

Download