44cb030df6ffaa060c34109cedf4e7925f50b5ac84540bc2b3076bd523ea8c80

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-09-2022 23:26

Target

44cb030df6ffaa060c34109cedf4e7925f50b5ac84540bc2b3076bd523ea8c80.dll
Size

34KB
MD5

3ea6d1c089ec7aef8930c557a99bdb46
SHA1

3bae52f229146fab17198f25f498250fb943a630
SHA256

44cb030df6ffaa060c34109cedf4e7925f50b5ac84540bc2b3076bd523ea8c80
SHA512

c10e505f3c588d074130c28f478f266db20569cd8a186ef30e8ef70a45534dd7501ac0e144cb688a9e4e9f71db96ecb16f6fae2c677e083eb0add1b9306a6533
SSDEEP

768:TPkbmjTTPBjupvnNr77OpcdPuOJ332RgB5:TkbUTVjuf77OpobH2Rg7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28
PID 1044 wrote to memory of 1368	1044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44cb030df6ffaa060c34109cedf4e7925f50b5ac84540bc2b3076bd523ea8c80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44cb030df6ffaa060c34109cedf4e7925f50b5ac84540bc2b3076bd523ea8c80.dll,#1
  2⤵
  PID:1368

memory/1368-54-0x0000000000000000-mapping.dmp

Download
memory/1368-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download