c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 14:05

Target

datastate.dll
Size

75KB
MD5

28f0ccf746f952f94ff434ca989b7814
SHA1

506e85d2de6377492d90b98aa20663b0ff3ce32a
SHA256

6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2
SHA512

b74ebb9a12079caf7bc074bb977ee94dc6ffcae845c1120026f384953fe2499d4bb0cdb7b6dcb2ff7f37e8135db06048815cc13d1837235eb11fe86e3c4572ee
SSDEEP

768:BdPmXHrMcRkZrVlqE6BI6TalNPzrrSRTy3IXGX8prYXDRMMUKkVp4VdEhahE:r+XrMzriE6BorrJIXJpCRM7fVp4c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31
PID 2148 wrote to memory of 2092	2148	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\datastate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\datastate.dll,#1
  2⤵
  PID:2092