c9f23a967c2f7f4d6f467dd1d55d6b01183d4aa7339a7a3c1f22a0d509d6c3ad

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 04:29

Target

IMG_24102011_150_JPG_0000000094893i94893le934jje939333399944059948.dll
Size

111KB
MD5

ebd34462ceec86a6e1eff44e574df9d1
SHA1

7e50bb775b1868a4e4612daad4ae464fea3c9fb5
SHA256

e959826e09a3d59ed01c7b829b13584e9de359e4e1563b446f7c515f4aafbcc6
SHA512

08facf4549efcb28da871b1b0ce50cdcbe10066bc7f6242ad2ed1723eeeae4093c5fac5473d9ccd6a0bb742fe08ed52c5765f463acd2eb9838542e9ca4d81087
SSDEEP

3072:T3E6JryyQkNc15TgqHzbh+OOIimIdsYVwuCvJ2zlk9:T3RJODmcE5vmIdsYVwu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28
PID 2004 wrote to memory of 1572	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IMG_24102011_150_JPG_0000000094893i94893le934jje939333399944059948.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\IMG_24102011_150_JPG_0000000094893i94893le934jje939333399944059948.dll,#1
  2⤵
  PID:1572

memory/1572-0-0x0000000000170000-0x0000000000192000-memory.dmp

Filesize
136KB

Download