6f8b540361c734dd1b08c829483cc31674ad5dd38909e6e9692bc95f2dfaf24e

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:16

Target

$SYSDIR/atl71.dll
Size

87KB
MD5

8f2097e8b174f38178570c611464935f
SHA1

86476819229f4bf00f32e5f0969e19c5b61d1b2a
SHA256

3f25e7b097b65eaf82a6d5b58646dff38ca19347664f40c2b8a409b9d6939457
SHA512

85f60b00b4d2e7d5047d4d0f1b834c23073797fcaea0e14161baac9a7ec719d79782a17ba6aa8da55b933c89b3d94c89696da194c3cf7170c746c8bab7e38904
SSDEEP

1536:oERCMDI2M2n5lJsYx+J55I+EfA+GsKdQrnzEC560hf/GLKqTM4Zwmibv/4:HnM25V+RI+IGsKVC560R/GOqTJZwmI/4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30
PID 1920 wrote to memory of 1328	1920	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\atl71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\atl71.dll,#1
  2⤵
  PID:1328