d8a387313a1a41c983729bf989d7c99fe92315884cd1327da210b65c173e9574

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 15:47

Target

Lang/en_US.dll
Size

92KB
MD5

bb0318356c35f4a0c6c59b427208f491
SHA1

00fd513e6d82d0674ea95404fec235decc845aa5
SHA256

ff87b64931f48fb1db2d94f95b9e8b352aa696f950e8c491767ad46eb474db08
SHA512

9c45b3cda7277bf65d76d1e08413a885a8fc627078a84b77286769e60f10bddc961b064995f2bd9d774d704913cf773fe37e0eb8ed22050a81c1394fb71848f7
SSDEEP

768:aOTlDSvDubNIrytDXSmPzgFhPyvluF8YJWnIR29iKugXrx7pLV5PmSOJ7blGqUex:aOTlDS763DXSKcFGluAgCrX4JKeZ1zZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30
PID 1480 wrote to memory of 2244	1480	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lang\en_US.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lang\en_US.dll,#1
  2⤵
  PID:2244