5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 06:46

Target

CommonLoggingExtension.dll
Size

151KB
MD5

c208b1d248531b0035a8f3a3235017c4
SHA1

007a1541aa837f07070bc5bf5207e1c52c6441ef
SHA256

e28f4d9dad57441c3690af654733804cfa06a94ba22ce64854e82bbe55e24c68
SHA512

c5d4f074449900af68b84f06e7a8aa1a2b78171a8f9e86bdea05a6868ec0b7048a7735ad2d2caa9742e9844b70abef7e02b8abb323039bd736377d3e31b29ece
SSDEEP

3072:xMO/k7ZqgzQzIpPTnvwxWbgbro4F1LuB2qWiCzUcBW1ogaeqnFYLIDhQpebQU/zR:xMosAEMIpLnvwxWbgvosLuB2qBgUcg16

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30
PID 2776 wrote to memory of 2160	2776	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonLoggingExtension.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonLoggingExtension.dll,#1
  2⤵
  PID:2160