9abedf1fc9c2a031b94e02e1d6b13de3225fcef9c988e0fa6d881c246536ab5d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 10:33

Target
9abedf1fc9c2a031b94e02e1d6b13de3225fcef9c988e0fa6d881c246536ab5d.dll
Size 1.1MB
Sample240603-mll5facf83
SHA256 9abedf1fc9c2a031b94e02e1d6b13de3225fcef9c988e0fa6d881c246536ab5d
MD5 637b022a9a51f47916d530cca5b5e73c
SHA1 11232e2bd4994436c18f27912f5830159b332cd7
SHA512 939c6ec9f075ce93cd1f976f730984d0ae6f72057ad07b4db032ed6a297d1d76bb55809be8cbd58600aa9fc382dc8bba19224450bc68aae456ed61218fe2f08a
SSDEEP 24576:Zj+KpPV5TIzkQmBla3p4Iz5I3M6cdjk65Jna+vXV3/Ds9E2Gs6G:RNMyC3jNdjHLa+vXKgG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28
PID 2460 wrote to memory of 2992	2460	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9abedf1fc9c2a031b94e02e1d6b13de3225fcef9c988e0fa6d881c246536ab5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9abedf1fc9c2a031b94e02e1d6b13de3225fcef9c988e0fa6d881c246536ab5d.dll,#1
  2⤵
  PID:2992