5d16db171d9f6776fc61261f34ef9c94b9cd0fd3620ff73dea18ea6aa954b949

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:36

Target

5d16db171d9f6776fc61261f34ef9c94b9cd0fd3620ff73dea18ea6aa954b949.dll
Size

6KB
MD5

e556566ea5e722e8afefc1afbf9f9e5b
SHA1

9bca5e225cda495e15cc8225ea828136fdded0ff
SHA256

5d16db171d9f6776fc61261f34ef9c94b9cd0fd3620ff73dea18ea6aa954b949
SHA512

03b1723ec39b5b6f4812b69db16ff5c781617ef9d15f4ca0724501460231068ebf28330709c6e06fd0832234f8e8c8e6c4713d3a5ddf5dd8881b2eac7b297b0d
SSDEEP

96:VGEETrMLH5sbcL4HVifEU2gLvdwyEEX1ZiJR8lIQnFoLblWZuEFubME:efMT4HIflATZLblADAbD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28
PID 1556 wrote to memory of 2088	1556	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d16db171d9f6776fc61261f34ef9c94b9cd0fd3620ff73dea18ea6aa954b949.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d16db171d9f6776fc61261f34ef9c94b9cd0fd3620ff73dea18ea6aa954b949.dll,#1
  2⤵
  PID:2088