4f04bc656806f197509849e6dc9e0905ce35487042b7460b941ca95e8d803fc3

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 21:10

Target

4f04bc656806f197509849e6dc9e0905ce35487042b7460b941ca95e8d803fc3.dll
Size

81KB
MD5

53abf09196925d7dfa798b62915652c0
SHA1

6fd4fef3f8151d4be099dc54150041cdde0b0de5
SHA256

4f04bc656806f197509849e6dc9e0905ce35487042b7460b941ca95e8d803fc3
SHA512

9d8707853069d16389d415bdfc8f7c1f3b05c92cb720787a3df6cbf2ab495e3abc7b806c2194dd96a3d4301dae3e585867f871f7bfcf96e763464cd955b4667a
SSDEEP

1536:NtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8W1:N4v4JKXTx71w0ArSsXF3enq8W1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28
PID 2416 wrote to memory of 2928	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f04bc656806f197509849e6dc9e0905ce35487042b7460b941ca95e8d803fc3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f04bc656806f197509849e6dc9e0905ce35487042b7460b941ca95e8d803fc3.dll,#1
  2⤵
  PID:2928