ebaf276ce891f31ab1a69f19ccc70e5f658f92d0f3bffb2d59fd010c7dd0261e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 14:52

Target

ebaf276ce891f31ab1a69f19ccc70e5f658f92d0f3bffb2d59fd010c7dd0261e.dll
Size

2.0MB
MD5

935a6e5551336327a260778ec69d446f
SHA1

9103b3d236d575bd70c234ac6ddc17dc92cbfc8e
SHA256

ebaf276ce891f31ab1a69f19ccc70e5f658f92d0f3bffb2d59fd010c7dd0261e
SHA512

d505f18db32eaec0a861aea3b2aee407de9b5705d07d97ce7a751e3a869c24857f2f0b9b5c18c6cabe2906fa80a9d749d97095e26a9c6751853e21ec70e80e9b
SSDEEP

24576:cYG7K9TLlSQCDv8ivLDgpYpk9MRS+MKMGAPG4t1RwLs57kcJrVhW4LfmiMg9fvwk:cNeVJCDCpmqOSBCLsrJpNzmLg9fvwk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28
PID 2080 wrote to memory of 1244	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebaf276ce891f31ab1a69f19ccc70e5f658f92d0f3bffb2d59fd010c7dd0261e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ebaf276ce891f31ab1a69f19ccc70e5f658f92d0f3bffb2d59fd010c7dd0261e.dll,#1
  2⤵
  PID:1244