902c8e6222173734ab37429407586383fca156408b119e2f21537be5efb8608d

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:59

Target

c53ca6409475f70795af6a9d7bd472a0N.dll
Size

222KB
MD5

c53ca6409475f70795af6a9d7bd472a0
SHA1

815c061b02afb79df65666d7125200b4a9afec3e
SHA256

902c8e6222173734ab37429407586383fca156408b119e2f21537be5efb8608d
SHA512

25996f1e4dcebb2c7bdbdeaefeff8bfb0fc9b8cf81da4b94ab44f9c30d6f7752b02ef9a1f8e45cb674727adf8a0cd8d4dd8c299fa98ac3ddc72beafb38063f40
SSDEEP

3072:9O3qd+oYNZGEHeL42apHC8QaBYe3RbS8DtLAx0YCmoeOihpEliI6XBJWxcHe4ir:w3C+X9HYSGy9quihpEAWK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30
PID 2648 wrote to memory of 3064	2648	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53ca6409475f70795af6a9d7bd472a0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c53ca6409475f70795af6a9d7bd472a0N.dll,#1
  2⤵
  PID:3064

memory/3064-0-0x0000000074ECA000-0x0000000074EED000-memory.dmp

Filesize
140KB

Download