81e356050e865cd7bd55b962045fc4b4211a18b436e395aa8d6395ef2ced954c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 13:37

Target

81e356050e865cd7bd55b962045fc4b4211a18b436e395aa8d6395ef2ced954c.dll
Size

2.5MB
MD5

93b8cbd2876c433dc0749d60734c26ab
SHA1

c1fc45e437bbb7cb44a1b7ba8d476bd3f89c76b2
SHA256

81e356050e865cd7bd55b962045fc4b4211a18b436e395aa8d6395ef2ced954c
SHA512

b2de70eda9c56a1776d73b9071e4bd36f06462132aadeb232e0233e5972403b56fd4a2e1fc8a6755f97b98e6c9d9db31376c34162d65dcd22a229c6b2e23e3a7
SSDEEP

49152:eFIAtQz67N9Nu+XesQj4G/W1NKXY5D9KRhnMnwWVq7oPvrBrlITZ0Jn1viqIA1qN:eCN2Nu+OsQjZ/ebSMnwWU7OvrBrltkaU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28
PID 2184 wrote to memory of 2168	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81e356050e865cd7bd55b962045fc4b4211a18b436e395aa8d6395ef2ced954c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81e356050e865cd7bd55b962045fc4b4211a18b436e395aa8d6395ef2ced954c.dll,#1
  2⤵
  PID:2168