b0ae8d6a0e51a6d372b22b639ab1b4c56435f4a601a1bbb7ae11c8889cbf6776

Analysis

max time kernel
119s
max time network
20s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 05:10

Target

659538e2b513bc78ad332d221744dab0N.dll
Size

7KB
MD5

659538e2b513bc78ad332d221744dab0
SHA1

6ac5b266e0ee0178844b31a99d97e78a46f534f0
SHA256

b0ae8d6a0e51a6d372b22b639ab1b4c56435f4a601a1bbb7ae11c8889cbf6776
SHA512

b5e5da9f069a89b0630cd65f9bf97098e395601cda8690374c13e2afb503a6ba3443b5810ca7f2dc58d03f543411c90300edae2d7e0bea1aed29ddb0600c2f55
SSDEEP

96:DixZjmjtjd8jPjcZGR5TI7l31rudUfMOeNbfQFVKIQfUmKeCM0CyjS:unSR6bgYA5R+UfMOe5BIQfUmzCM0Cyu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31
PID 2632 wrote to memory of 764	2632	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\659538e2b513bc78ad332d221744dab0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\659538e2b513bc78ad332d221744dab0N.dll,#1
  2⤵
  PID:764