f12f279d66d32eee84c09ba0b6a6a0792e667423a21d70d67c89660cc2a5d46a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 18:19

Target

virussign.com_6393e45731ff7b1e29b630d9933e7030.dll
Size

131KB
MD5

6393e45731ff7b1e29b630d9933e7030
SHA1

13387cdff5d3452b4b464531e04a111b21b80eb7
SHA256

f12f279d66d32eee84c09ba0b6a6a0792e667423a21d70d67c89660cc2a5d46a
SHA512

ef2f9030c043002e344f210259fb8711d4a57c844ca4a4fc29086102de3482fd7ab9176aeb4ba67fd15e14e65cc8e625214ce5b7310d90d839978ee782645685
SSDEEP

3072:aBoQ8C6kW1yg7uOOcFA8riMnzhI2VQ2BP+ic7MV8fZZ+Ip/9:a6Q8C2l7uODO8rv1HDJcPF99

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.com_6393e45731ff7b1e29b630d9933e7030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.com_6393e45731ff7b1e29b630d9933e7030.dll,#1
  2⤵
  PID:1592