d6941cafb3f05b04e4d4d87f565b646171a698762a1c2662532747a6b435a01d

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 12:59

Target

d6941cafb3f05b04e4d4d87f565b646171a698762a1c2662532747a6b435a01d.dll
Size

150KB
MD5

2872d798ec8edd9bf430b30457386a76
SHA1

f0f7e33fc0b966d7b3e51f8d0481f386d9a0344a
SHA256

d6941cafb3f05b04e4d4d87f565b646171a698762a1c2662532747a6b435a01d
SHA512

fcfd8079c87c0daa935e879846a2bbf619aea4a85ce0af19139c74ea52b5733c4f53866c516402f74f79dfc05abced942132086dd19dccf42ae1bf97cc017303
SSDEEP

1536:0NtJIsLJas80zQH81cGdFmhkrBP/GcJZb8XGZPERREul/9dq1N6zCM:0N0spjzQffh0P/D10Lq1N8CM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28
PID 1700 wrote to memory of 2180	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6941cafb3f05b04e4d4d87f565b646171a698762a1c2662532747a6b435a01d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6941cafb3f05b04e4d4d87f565b646171a698762a1c2662532747a6b435a01d.dll,#1
  2⤵
  PID:2180