ed5ee26d63bc7f19ac3a1091d189348979b77c79d64dbdb1111bde40d485a6a6

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 06:44

Target

5e679a4c78b3aa9ffe3efc73c5399dc0N.dll
Size

5KB
MD5

5e679a4c78b3aa9ffe3efc73c5399dc0
SHA1

15d09b1375ff4378db942d290abf462ad7aa37ca
SHA256

ed5ee26d63bc7f19ac3a1091d189348979b77c79d64dbdb1111bde40d485a6a6
SHA512

194d5a09e05958d920ca1438bc6b6fc1b114c3f3c825ffc4601797ac798aaaccb5ca9f9b83be87cad2706623f5865c196be1c7c2fd7b367d352d9c77256b3bb0
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqzTkmdKf7H0YLKYk9SHfvdOHFZJ:hy859x0P8MazTHYLKYkgfvElZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31
PID 3032 wrote to memory of 2648	3032	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e679a4c78b3aa9ffe3efc73c5399dc0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e679a4c78b3aa9ffe3efc73c5399dc0N.dll,#1
  2⤵
  PID:2648