59fe354854ab0081caa7b5d90e09086a83a7f3a99cc1af8b03fbcf1fdd49803a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 08:17

Target

59fe354854ab0081caa7b5d90e09086a83a7f3a99cc1af8b03fbcf1fdd49803a.dll
Size

508KB
MD5

52bcb1c7c351ed9bae8229197c2248e5
SHA1

4fcd6f64a62a1693a5325ceb490df2fdf1f1216e
SHA256

59fe354854ab0081caa7b5d90e09086a83a7f3a99cc1af8b03fbcf1fdd49803a
SHA512

d28725a7f20fc8344af3b8c8bd726d5e80d050d8eba296cf3d0cfbc0d181c1a05167452d581d7c216845883eeb23f0671cd52f5e67b3cc0d79fe04f5653e5796
SSDEEP

12288:kI3W68TAfLAay2MPMjLxbCkHIBw8WWIy+377:dWOfLAay2ME317

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59fe354854ab0081caa7b5d90e09086a83a7f3a99cc1af8b03fbcf1fdd49803a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59fe354854ab0081caa7b5d90e09086a83a7f3a99cc1af8b03fbcf1fdd49803a.dll,#1
  2⤵
  PID:1260