de2a0fa7b4b7d5c4f095e225490ba3feed0235011e49f198ac4ca4d1024b3b97

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 04:36

Target

de2a0fa7b4b7d5c4f095e225490ba3feed0235011e49f198ac4ca4d1024b3b97.dll
Size

7KB
MD5

a8516e159c076ecddea53440d98207de
SHA1

ec79cd23851ea022f1cc8bd39c923b4b23797ff5
SHA256

de2a0fa7b4b7d5c4f095e225490ba3feed0235011e49f198ac4ca4d1024b3b97
SHA512

4b8831580dbf90e0ff6f465e4f38e683a125ed3b0cc2dc508d15690805b01613e3d174f25cb0e244d678dc4e8861499ac665be48139a0b7a2b6417f1c8cc7a37
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWqbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPgq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28
PID 2392 wrote to memory of 1916	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de2a0fa7b4b7d5c4f095e225490ba3feed0235011e49f198ac4ca4d1024b3b97.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de2a0fa7b4b7d5c4f095e225490ba3feed0235011e49f198ac4ca4d1024b3b97.dll,#1
  2⤵
  PID:1916