404c608978a9ff3e030ca85423f6e6ca82f355ee65f54b43ab39fbefdfeeae07

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 20:45

Target

404c608978a9ff3e030ca85423f6e6ca82f355ee65f54b43ab39fbefdfeeae07.dll
Size

8KB
MD5

62699bd695f92af0178f29df6272566d
SHA1

69f59e7f968676265bb130617496e8f62a4116e5
SHA256

404c608978a9ff3e030ca85423f6e6ca82f355ee65f54b43ab39fbefdfeeae07
SHA512

7a9a65af2bc6c5b77d82c3c14bfa65b509dd3697a7303e125977a2b01cbc33ea7472b7382fae7305e259921bffa9ef756f32985d72127a1b16f1c1fa01f81b58
SSDEEP

96:ahPTVsHOlyzlCEQridCqepIeydcjxwbGt6WY90hIOBXDp1zE0hJHgmln8X/eRtgK:yTVTlyhCEQJWiJhRlNnGxOjZZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28
PID 3040 wrote to memory of 2892	3040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\404c608978a9ff3e030ca85423f6e6ca82f355ee65f54b43ab39fbefdfeeae07.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\404c608978a9ff3e030ca85423f6e6ca82f355ee65f54b43ab39fbefdfeeae07.dll,#1
  2⤵
  PID:2892

memory/2892-0-0x000000005FFF0000-0x000000005FFF5000-memory.dmp

Filesize
20KB

Download