d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 22:09

Target

d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd.dll
Size

40KB
MD5

836ba9cdcaa1360bf0518f2c5718789c
SHA1

c4d8500c5684cac2a49da10b6a54cada7268c618
SHA256

d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd
SHA512

532d15a9ff7e1451822894042ec91887327a4e62b9ff50543be1f5d93c5a1b4fbd5932da3b3d3731989b377c09a314d28ec0ac4ad6b3e830a227b4a5eae65068
SSDEEP

768:W7UIfX493uKFWPjFOUjeuB1l+mNaxXbPq2I99VIo1xgF2stXBdS:OtItuKFWPjFBeuHELXbfHo1xKfJfS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26
PID 1424 wrote to memory of 1852	1424	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd.dll,#1
  2⤵
  PID:1852

memory/1852-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1852-56-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download