f39944ecd04770457c54f04a1af6bec78538dedd9bb3c27ff4cd4d27e2b60624

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:35

Target

f39944ecd04770457c54f04a1af6bec78538dedd9bb3c27ff4cd4d27e2b60624.dll
Size

730KB
MD5

4e60a7e7c3b65d4a732fc1fea72c41a4
SHA1

0af1efbbbc9406e90247515bae8b3852e55463f2
SHA256

f39944ecd04770457c54f04a1af6bec78538dedd9bb3c27ff4cd4d27e2b60624
SHA512

8115cb1ca68bc4f1e37096e936a32f3bbb67f4641fca3e4cdb5729eeb6df6a94467fd1b05c9ed1afe60714ee89947914969fda312f9ddc0aa54962a76cb7385e
SSDEEP

12288:ELOF7gC5NRJI7XHgZQKhJgeCmALB49+0VQEYPCMH/V:EKF7JNR2LHgZpJEbLqXYPlHt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe
PID 2240 wrote to memory of 2080	2240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f39944ecd04770457c54f04a1af6bec78538dedd9bb3c27ff4cd4d27e2b60624.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f39944ecd04770457c54f04a1af6bec78538dedd9bb3c27ff4cd4d27e2b60624.dll,#1
2⤵
PID:2080

C:\Users\Admin\AppData\Local\Temp\3266.tmp
C:\Users\Admin\AppData\Local\Temp\3266.tmp
3⤵
PID:2124

memory/2080-0-0x0000000000520000-0x0000000000563000-memory.dmp

Filesize
268KB

Download
memory/2080-1-0x0000000000520000-0x0000000000563000-memory.dmp

Filesize
268KB

Download