681d9d140646eeb7899634648887f55f3be5892bc237bab9eb97da76b95f52e6

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 22:57

Target

681d9d140646eeb7899634648887f55f3be5892bc237bab9eb97da76b95f52e6.dll
Size

435KB
MD5

38927e47d7fdafde3ea6215438c3ec5f
SHA1

6aa92962c5190763df0a9fa0f7462622f700a48e
SHA256

681d9d140646eeb7899634648887f55f3be5892bc237bab9eb97da76b95f52e6
SHA512

510d7d89a8773b7275505333a4e72314a32b44792cdd2aba5c96d689aebde0fe715e62df1a33d0341a92db24e60b92d515a550f10bbe54e54bdc60411883f51e
SSDEEP

12288:3QcCHyQdCb4R7sUHmDnCl3QmedV2fL3xQBnrRav4vX0WezQ0aAlkkbmzcyRb1B9+:szBKtS3zQ0aHkbmzcyRya9VU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28
PID 2096 wrote to memory of 1908	2096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681d9d140646eeb7899634648887f55f3be5892bc237bab9eb97da76b95f52e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\681d9d140646eeb7899634648887f55f3be5892bc237bab9eb97da76b95f52e6.dll,#1
  2⤵
  PID:1908

memory/1908-0-0x0000000074A20000-0x0000000074A91000-memory.dmp

Filesize
452KB

Download
memory/1908-1-0x00000000749A0000-0x0000000074A11000-memory.dmp

Filesize
452KB

Download
memory/1908-2-0x0000000074A30000-0x0000000074AB0000-memory.dmp

Filesize
512KB

Download