a79c1b121f399be2ab18e0b9c32b6468f704e9559dc42c0a1b1d4c27b9e56705

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 01:30

Target

a79c1b121f399be2ab18e0b9c32b6468f704e9559dc42c0a1b1d4c27b9e56705.dll
Size

584KB
MD5

2b0fcefc279561e921bc3f57df69ea7c
SHA1

306cdaf577ef5cb190cbd43a3342202584a2a4d4
SHA256

a79c1b121f399be2ab18e0b9c32b6468f704e9559dc42c0a1b1d4c27b9e56705
SHA512

c717277da6ab5f45c7bb64460423ae4222c8c7b8f83ba6b08fee5d734a21709911d0a464034b939b08a793c16d2b6f4d9651fed758cd65309aa39d945d6ee3a4
SSDEEP

12288:zaysBkPuFWKGgMV1EvSJxCeph0lhSMXlCkZwSx0Xx:OysBkPTV1Evs5h0lhSMXl7ZwSx0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28
PID 1844 wrote to memory of 2848	1844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a79c1b121f399be2ab18e0b9c32b6468f704e9559dc42c0a1b1d4c27b9e56705.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a79c1b121f399be2ab18e0b9c32b6468f704e9559dc42c0a1b1d4c27b9e56705.dll,#1
  2⤵
  PID:2848