e2dca85ba15366a41846b1152329ad9c7abc8b410b5ee51d00b812c1d1eae761

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:39

Target

?????10?/tool.dll
Size

1.7MB
MD5

25f603a5d4f35c396494e249c8dbc859
SHA1

639169d824a37f3d26e080bc9355828b0976a23c
SHA256

9ccded759866e770385cdb34c38b0270edd27580c60aac17848e1f9beee1960f
SHA512

669be888e93b0fc9a431a481b0c60bac49a2cc599d63a2eb2d66d1eb037689c16785f9825f12733fd2920435183b80c36391c9a8d0663593925e478f11f667eb
SSDEEP

49152:Wv86BZ1xw0Mvv87cRSa2noqh3fwX6SRu8qxhjkMvi+NoMvFP:36BZ1xwfvMcRSa2oqFfwX6SuhjkUi+Nz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe
PID 2984 wrote to memory of 3000	2984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_____10_\tool.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_____10_\tool.dll,#1
2⤵
PID:3000

memory/3000-0-0x0000000074D90000-0x0000000074F46000-memory.dmp

Filesize
1.7MB

Download
memory/3000-3-0x0000000074D90000-0x0000000074F46000-memory.dmp

Filesize
1.7MB

Download
memory/3000-2-0x0000000074BD0000-0x0000000074D86000-memory.dmp

Filesize
1.7MB

Download
memory/3000-1-0x0000000074BD0000-0x0000000074D86000-memory.dmp

Filesize
1.7MB

Download
memory/3000-4-0x0000000074D90000-0x0000000074DA3000-memory.dmp

Filesize
76KB

Download