28de23a445270e17e918da02af76304c596b1e94c14c712e493bdd9cb7797783

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 20:20

Target

0424a02bcdf4e410b8e2d242552357e0N.dll
Size

6KB
MD5

0424a02bcdf4e410b8e2d242552357e0
SHA1

f52b94c9bcb4ff651057ed75ad4d24319f4053d4
SHA256

28de23a445270e17e918da02af76304c596b1e94c14c712e493bdd9cb7797783
SHA512

723916b1b547354e304b797590d98a0bd260346a9e2544bc9e09840b647789c4467858c68f3b7a2f7d4f49bbf1697ba1190990e14da7d4437678c66c5dec5edf
SSDEEP

96:nEY2RrF1eqwi4Wy6gRlDfqytx3/48re7eSS1HBkkuWHgc:EHRh1eppa8Ff5/FrHb0TWHgc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30
PID 2388 wrote to memory of 2068	2388	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0424a02bcdf4e410b8e2d242552357e0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0424a02bcdf4e410b8e2d242552357e0N.dll,#1
  2⤵
  PID:2068