e651806d599c8381b832b9b9b64d986110bea46b646a2b83638d0de94eb99180

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 10:58

Target

$0/basicscan.dll
Size

754KB
MD5

51f5e29be501ed36ef70aae960824a7d
SHA1

7e6972fe42a6fdfc3fbd00bade3c1c3f57f84db4
SHA256

6d3cc056b2c98a545ec57a41d0da8ae55e66c5013f4eb587f34e54f6830d2efe
SHA512

7e39928d5df8cb343fe2caf5d1b5032b2911e8a49bc4036a60a17c338682331c0010c29b55408f25d11e54fec98b2b0fede8b357172bf8fc50f0aff142154df4
SSDEEP

12288:T4AXf+kOos48yROH1/oyKYzMKbL2d3O1b67UGbNuQh6VEuC8pWreM:JXf/Op48yRy1/oyKYoKb6qEUoNuQh6rs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28
PID 2228 wrote to memory of 2304	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\basicscan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\basicscan.dll,#1
  2⤵
  PID:2304