57f5e297b6514088a876f196167e9693b5a4f38cdac795be3db4b9ad7cb713c8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 13:24

Target

b72cc96bb74c3153dd6201a6df10d8b0N.dll
Size

124KB
MD5

b72cc96bb74c3153dd6201a6df10d8b0
SHA1

1327b3b0a4eaabfd9285e1ed39b0d9431eb3059a
SHA256

57f5e297b6514088a876f196167e9693b5a4f38cdac795be3db4b9ad7cb713c8
SHA512

e823212f6cb2c7c62add27fc9dd064e59eeb8106552cbd4be96db147037cf8799eba56f13600e932f8db628c911373b2761ecde5507f583ddfa6f942e966acd6
SSDEEP

3072:G5CZZu/h6AABVDPHjvk10tReQ+DTEUvvrXkJVgbugxj:G5yo/XAbPHTkfEUHrXkJVgbuS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30
PID 1628 wrote to memory of 2760	1628	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b72cc96bb74c3153dd6201a6df10d8b0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b72cc96bb74c3153dd6201a6df10d8b0N.dll,#1
  2⤵
  PID:2760