983d625fcf16f42d3fead61360f885b6990a66364fd8aebe86a9890974626b60

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/09/2022, 00:18

Target

Kidux32.dll
Size

742KB
MD5

544cd51a596619b78e9b54b70088307d
SHA1

4769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256

dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512

f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
SSDEEP

12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27
PID 536 wrote to memory of 280	536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Kidux32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Kidux32.dll,#1
  2⤵
  PID:280

memory/280-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download