0b9666ebd7b9766c8d3b397cac18e96e54c179b93d344ece5bf793427a6a36b3

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 21:22

Target

0b9666ebd7b9766c8d3b397cac18e96e54c179b93d344ece5bf793427a6a36b3.dll
Size

33KB
MD5

55a9c3ce0f1c92149453c6070dd62220
SHA1

b9c889e769e2ebe63f7c09cfec969b3e11f0eca3
SHA256

0b9666ebd7b9766c8d3b397cac18e96e54c179b93d344ece5bf793427a6a36b3
SHA512

a489c5a6fd9a4a18fcd4410015ea545fddbed5a2c57a3499c4c9a94b585fd520ea76077fb1587e58002189a46496e97f3b9b3927cae370495c6480f7ed65acc9
SSDEEP

384:OPRLc7GoxDwoVEFCWrrbAukrrZMsjS79+ID96EkeU+l2O1ZC2Sgo6j2rpAdDfd9c:JDDwoaFJGrZMkShX1hlDCf6mikts89zF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28
PID 2436 wrote to memory of 1292	2436	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b9666ebd7b9766c8d3b397cac18e96e54c179b93d344ece5bf793427a6a36b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b9666ebd7b9766c8d3b397cac18e96e54c179b93d344ece5bf793427a6a36b3.dll,#1
  2⤵
  PID:1292