22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e

Analysis

max time kernel
9s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 10:11

Target

22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e.dll
Size

17KB
MD5

2e2a01888b143fc25c7fd3851602c674
SHA1

c4a77193cfe2b56d7e244d8be392ce6596aa8125
SHA256

22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e
SHA512

5f80aa62c7e22d88a34b4965e165bbcde11b18db5ed57583e671281a266857d6e961bd0e7bedf06c387ed173bd6f588788109e1cee53d860bad8d87131c537b5
SSDEEP

384:i8axTh2IMTMCuRGRTkMb3+cl8PueXjPc0:Daxt2IMTxuRGRTr3rlCNc

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28
PID 1368 wrote to memory of 2036	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22db7941124dadd534c161d62dc8d55edafe4a4be98c2a98bd699ce1782cdf0e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

memory/2036-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download