a1bc2b93e236345a6b7408e01a9ce19e1aaf0cd0711ce7b0468891296e94cd17

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 00:53

Target

a1bc2b93e236345a6b7408e01a9ce19e1aaf0cd0711ce7b0468891296e94cd17.dll
Size

235KB
MD5

56e99a7f18f863e6a16082baa0c463c7
SHA1

9f1969a0536bc1d94b60f9ae95c99a75360f975c
SHA256

a1bc2b93e236345a6b7408e01a9ce19e1aaf0cd0711ce7b0468891296e94cd17
SHA512

e97dd7d2fbe88347a6c82f7b2a3da71be431b5740ceaadb345ec968c6adce542ef3c55f61d92a913ee18eb1fedb64a5e08a26fb6a6bd0d2805df15b383bc0392
SSDEEP

6144:WmmUoI4F5S9F04uRJm52YK+/TZru1FjZ4:WmmUoIc5SQ4uRJm52iu1FjZ4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28
PID 1068 wrote to memory of 1492	1068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1bc2b93e236345a6b7408e01a9ce19e1aaf0cd0711ce7b0468891296e94cd17.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1bc2b93e236345a6b7408e01a9ce19e1aaf0cd0711ce7b0468891296e94cd17.dll,#1
  2⤵
  PID:1492