122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 01:08

Target

122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb.dll
Size

24.5MB
MD5

e6a1b79aceb1a98016c6edcf8f3d0a65
SHA1

bddca6de5c54d2c38d78a102c05fd3bc89c7adf1
SHA256

122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb
SHA512

ad7c62e12a6727b6327248f1d2d12b074269e72d249f52b5bc7991156c0f7f9882c911011a13a54ae501c68d5d378c182fa84c97d28c391fb2da3f56774a7d2d
SSDEEP

786432:BIIIIIIIvIIIIIII8ycgIs9wRX+LwtJ0a+XOU094IdJ3ar1KlcWuVy:BIIIIIIIvIIIIIII8ygxcO0acOUWdFam

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28
PID 3056 wrote to memory of 1996	3056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\122f13fcffd3a8747c05829fa21c72dbda254412d88e43625906915f1b9ef4cb.dll,#1
  2⤵
  PID:1996

memory/1996-0-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download
memory/1996-1-0x0000000010000000-0x0000000010088000-memory.dmp

Filesize
544KB

Download