b622013c43ce8d926d5adad74ba9364c37d31b8343510e36dc5d43962b6e92dd

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 07:24

Target

ADManage.dll
Size

56KB
MD5

79256ce10b38a45391862e99bc0ec484
SHA1

ca2a44c876a434fbd2fd1cfa7754b8052905cd08
SHA256

a3a61f0aabdd2412471764607eb01e16969de905299108996bf1b16da4a49230
SHA512

0a8fb40b76eb55837a4ccc499c0c07bc900d6d2c05eb789badc7c1ef3aac19df9cd4053f8673249160aeda18e4fc1182fb71979528bd77076c22253bfe891165
SSDEEP

768:DarJ7DkkSUvipOAp+QBH9P/CfMhCRL0ciRuuh+u+CttYNXM+PCFT1rcB5ZiuKdpS:DarJ3xWpB10LCvYNLPGRrcB5ZzKdtDu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28
PID 2216 wrote to memory of 2784	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ADManage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ADManage.dll,#1
  2⤵
  PID:2784