6bb8615edefc92f9175e9de57cfe78c33744a2cff12ff325c0a3d79e0104e35c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:57

Target

G/ProgramData/Key.dll
Size

94KB
MD5

d1a574cd082e8f9f64eae8de70057bf3
SHA1

451531ce7a69f309efaa75ca598843064425fe9a
SHA256

647aa2ac98ccc612be0f87bc5a3917e578d4c7be15c438054580f66c3f059d00
SHA512

943f698995541ec5454020b5f11dc7122bdd46c371586062cacc37db4e2203d6ce6a563c3153c41cdc87b0d55723db06f15cf7d5751e319ff35e731827acf21e
SSDEEP

1536:djqjoQ3Qa9bYHcZ8b+6goplj+b9pCd2ZC7wY6KKMf91FWqTFg1I9/Z8P:goROMq8a6fplj+b9pCd2ZC7wY6lMl1Fa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30
PID 2196 wrote to memory of 2712	2196	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\G\ProgramData\Key.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\G\ProgramData\Key.dll,#1
  2⤵
  PID:2712

memory/2712-0-0x0000000000100000-0x000000000011B000-memory.dmp

Filesize
108KB

Download