f1b0ec8eb3214f80e956903727876cedc06a9d1c77fc149c4fd421ba9be12944

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:21

Target

8360f618ba852dcc0f08f412b25b57b0N.dll
Size

2.1MB
MD5

8360f618ba852dcc0f08f412b25b57b0
SHA1

05786ee7c01c78e59dd425b661ec402771f9e47c
SHA256

f1b0ec8eb3214f80e956903727876cedc06a9d1c77fc149c4fd421ba9be12944
SHA512

72fe82d0e4256834f32d97d8a83a23ec89e4dc77a8c64869669128927aa718ec40bd4cc689d5566c4a743719f7d3238882dca135bd786e7793e703e8e391da4d
SSDEEP

49152:u2tE7E2pDoZErCyA5sAvmL5kX/4X5Fx7e0qsTn7l:uTNoGNSBmL5kv4X57e0qs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30
PID 2692 wrote to memory of 2852	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8360f618ba852dcc0f08f412b25b57b0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8360f618ba852dcc0f08f412b25b57b0N.dll,#1
  2⤵
  PID:2852

memory/2852-0-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/2852-1-0x0000000010000000-0x0000000010219000-memory.dmp

Filesize
2.1MB

Download
memory/2852-3-0x00000000027A0000-0x00000000028A5000-memory.dmp

Filesize
1.0MB

Download
memory/2852-7-0x00000000028B0000-0x000000000299C000-memory.dmp

Filesize
944KB

Download
memory/2852-4-0x00000000028B0000-0x000000000299C000-memory.dmp

Filesize
944KB

Download
memory/2852-8-0x00000000028B0000-0x000000000299C000-memory.dmp

Filesize
944KB

Download
memory/2852-9-0x00000000029A0000-0x000000000323C000-memory.dmp

Filesize
8.6MB

Download
memory/2852-10-0x0000000003240000-0x000000000331F000-memory.dmp

Filesize
892KB

Download
memory/2852-12-0x0000000003320000-0x00000000033FC000-memory.dmp

Filesize
880KB

Download
memory/2852-11-0x0000000003320000-0x00000000033FC000-memory.dmp

Filesize
880KB

Download
memory/2852-14-0x0000000003320000-0x00000000033FC000-memory.dmp

Filesize
880KB

Download
memory/2852-15-0x0000000000190000-0x0000000000192000-memory.dmp

Filesize
8KB

Download
memory/2852-16-0x000000003C950000-0x000000003C954000-memory.dmp

Filesize
16KB

Download