5d2c0b97f643bfed4b11a34e047afaaa6cc80204173fb473824c9fd894c7154b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 23:18

Target

5d2c0b97f643bfed4b11a34e047afaaa6cc80204173fb473824c9fd894c7154b.dll
Size

7KB
MD5

200911f535460203dfe09602159efe1f
SHA1

f577240979503d7a289d36887a0fd9f20fd4b322
SHA256

5d2c0b97f643bfed4b11a34e047afaaa6cc80204173fb473824c9fd894c7154b
SHA512

3e18eaee4ecd397db55eff61b2db0f3ea591a08fde780a50aeb05f1b2f9e80bfde22adc85348c783cacfc602c9a9649bff7927e48ad99bd1421b600cfd97ed0f
SSDEEP

192:unSR6bgYwT7A7YM02O7LATPtf7x7A7AO7l7s7b:uZFt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28
PID 1868 wrote to memory of 2292	1868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d2c0b97f643bfed4b11a34e047afaaa6cc80204173fb473824c9fd894c7154b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d2c0b97f643bfed4b11a34e047afaaa6cc80204173fb473824c9fd894c7154b.dll,#1
  2⤵
  PID:2292