c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/dt_socket.dll
Size 13KB
Sample240603-pypr7sgc32
SHA256 509b6986a494c2440b8bf1f96b8c1976b7a7059a6e22942818d91e17e7ecb040
MD5 4c94557411dfddcb4febd401568a2c5a
SHA1 095275cc38afa66caf6dbf92ba84af3c635c123f
SHA512 0c2082238463c732ceb7618107f0ff82a1ccb0eac7374c1bc97b274ebe1fe50e0c883379583da762ef25d2f25757b39c0b1d449fe445048b1c6a100c7dbb3c27
SSDEEP 192:kXiWNRVcsKNXBREiOrqa+0M9gYnb/tSO5n89qQuWr/qSpgItvo9f2bbH:UiWbODXBaxq30xYbJn8LSfkbH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28
PID 1616 wrote to memory of 2200	1616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dt_socket.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dt_socket.dll,#1
  2⤵
  PID:2200