88cad3952c02dc2a6857ba73205d440d1326c051e7075bfb69a3429cb1f0a061

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:30

Target

bin/download/atl71.dll
Size

87KB
MD5

79cb6457c81ada9eb7f2087ce799aaa7
SHA1

322ddde439d9254182f5945be8d97e9d897561ae
SHA256

a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
SHA512

eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
SSDEEP

1536:kIlL9T5Xx1ogKMvw5Br7KLKLI+Xe+QnyH4Cc0tR6nGVp/VTbkE0DJ4ZwmroV:BtvBOI+FQny5R6nG//SdaZwms

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\download\atl71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\download\atl71.dll,#1
  2⤵
  PID:2244