fbaa1e11bad4cbc70e762e7b59dbb65ec05a8aa634b56339c0227df6f7200dce

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 03:51

Target

fbaa1e11bad4cbc70e762e7b59dbb65ec05a8aa634b56339c0227df6f7200dce.dll
Size

4.3MB
MD5

cd9057e30a56c0e77800ea986934f34e
SHA1

617199dd40a4ae0a0cda4d97af476d3d70940fb8
SHA256

fbaa1e11bad4cbc70e762e7b59dbb65ec05a8aa634b56339c0227df6f7200dce
SHA512

326621e23c4a37fe597c370f8901671a070523ed36f2720afd00cca2380ef148ac2883557dc7fc21bebce313fc038be549cbd477b20ece31615f9e43e46255c9
SSDEEP

49152:9La23mDGPvVCaL8y0vdlx9oPrxdtq5AjPDpoLvYLlPJLH/A:ZMyqC0atfA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28
PID 2844 wrote to memory of 2856	2844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbaa1e11bad4cbc70e762e7b59dbb65ec05a8aa634b56339c0227df6f7200dce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbaa1e11bad4cbc70e762e7b59dbb65ec05a8aa634b56339c0227df6f7200dce.dll,#1
  2⤵
  PID:2856