9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 00:39

Target

9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157.dll
Size

16KB
MD5

39bf7b295c6fb285675ecae5b7d84cc6
SHA1

133a14770c3fdf165d0b3cc9a14a3029b053247f
SHA256

9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157
SHA512

d3c385e47299804b6f9e0ffe5705581e3979ba534efea382795325f562ccd4922a00599aff7329d233649a7f72f7c5336e0696bc70e3a4f688b19f9208602206
SSDEEP

384:WlGAq8xdLSggxpWkdIjlxn1bH+jQtQL6K:WlNdLtgxpWRbH+IER

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28
PID 1124 wrote to memory of 1736	1124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d48aa42cac849d50f3dd1c7da881a301849b635068d549641fcafd4d7d75157.dll,#1
  2⤵
  PID:1736