28b61ff422dc2b07f26e5fdca25421e2d15ad39e8215c68225ec01a375032be3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 19:54

Target

28b61ff422dc2b07f26e5fdca25421e2d15ad39e8215c68225ec01a375032be3.dll
Size

6KB
MD5

7903d734316ea42e1d077ee271bfe6bd
SHA1

1b707c80e0c516ebe411c57630b2876e20669c75
SHA256

28b61ff422dc2b07f26e5fdca25421e2d15ad39e8215c68225ec01a375032be3
SHA512

6eddb56f9b61d196bd278bac583ded0cc1b75f7b333dbe7c5dc1715161b8fcad5bbe2d41114f70d528e75e441cf36430777fc3223011c51e4b9ec5b2d408d7a1
SSDEEP

96:hy859x0P8MagpCP+Uq5i35pART2Yx0hipwfvS476pMu/g:F5oLjpCPQ5iQRVxtpwfvS476Z/g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28b61ff422dc2b07f26e5fdca25421e2d15ad39e8215c68225ec01a375032be3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28b61ff422dc2b07f26e5fdca25421e2d15ad39e8215c68225ec01a375032be3.dll,#1
  2⤵
  PID:2488