73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 09:36

Target

73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f.dll
Size

38KB
MD5

aed9e846f4d7facc20cfcb9af7c462fd
SHA1

c529fb58785f86eda67cd8c2fbf98bfc09f082b5
SHA256

73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f
SHA512

1b8ac2a2c8f45054296cbf988f78399960ff455931e4b31a92953b15d426d4d43f354955e6d6d6f43d656960c036c8aa85711e7505a6dff2c5e157536d7cbd16
SSDEEP

768:j/mVuAeZcBam7spi9y3zBVtTG+1QnxoYQBC8:jeheGam7s3D3CxbQBC8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73f0096da8b48124cee2ef29db7312057bb302997d8984e2fc640b5bc548c15f.dll,#1
  2⤵
  PID:1224

memory/1224-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1224-57-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1224-58-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download