ee49d9e369ec752a28a6943d47d03b22b324797c74c4f02c969a27567656633d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 11:25

Target

b738d6a5bd71c84bb730eb7816646e90N.dll
Size

6KB
MD5

b738d6a5bd71c84bb730eb7816646e90
SHA1

c9635b1819d7203355a3348fd40dd260dcee6162
SHA256

ee49d9e369ec752a28a6943d47d03b22b324797c74c4f02c969a27567656633d
SHA512

a6a31d0b09cbb5a32e9767e2ded68c3483060c53c33a72ee30481fd8c6c36a8347fb00bdaf4f9f34d133a53b18106894329badbf671fdd01bd4c4cdc63a9c19a
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIytBqfgia8nhPs6YZ62j5ZWs7:unSR6bgYltBc5URftZl7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30
PID 1864 wrote to memory of 2472	1864	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b738d6a5bd71c84bb730eb7816646e90N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b738d6a5bd71c84bb730eb7816646e90N.dll,#1
  2⤵
  PID:2472