214485fe3b1d483b51acb14985dcb85048023cdc50385bdcc5d9bcdee6cb96e4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 19:38

Target

214485fe3b1d483b51acb14985dcb85048023cdc50385bdcc5d9bcdee6cb96e4.dll
Size

38KB
MD5

7e2f8fae9d00e912fe6df1bc834dcfe1
SHA1

deeb30b8f91ec8f3597dbfc20890b1b86553a8cf
SHA256

214485fe3b1d483b51acb14985dcb85048023cdc50385bdcc5d9bcdee6cb96e4
SHA512

dc5f0899757a057725fe31e1dcd50c9ecd8a19071ebdbbe4b9058be8ab64a6bec80f628ca4cca95b774a339262ff10ce729dc10095c3993915050bee9623064d
SSDEEP

768:q9qR3HuS/Sx0PJPJmIWOfhArthb97PKSKfASkgOQO2cdHZ:l5Hd/CdI7wskgOQBcdHZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28
PID 1776 wrote to memory of 2116	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\214485fe3b1d483b51acb14985dcb85048023cdc50385bdcc5d9bcdee6cb96e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\214485fe3b1d483b51acb14985dcb85048023cdc50385bdcc5d9bcdee6cb96e4.dll,#1
  2⤵
  PID:2116