3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 13:30

Target

3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476.dll
Size

524KB
MD5

3df37859f46be01b08e6e7dd3060f6d2
SHA1

5594b9d6d30d705a3a05f9e0d5eb11f6b34b7b5d
SHA256

3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476
SHA512

492c503744413ab7ef6a2570b316ed36a53aa1a121fb8622fe4574fe611c91788e3d0435fc9013cc40d455d84c6eab940668a68e819debaee785cae53dd2d7c4
SSDEEP

12288:OVr0/yDvpHL3ks7oNZE7KHWfRS+nsKPLOCh+H1:OrLpbd0ANSYaCoH1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27
PID 1380 wrote to memory of 2028	1380	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3892721b8068aff9080965fe5eedf30dd488ef5d08c12234af66a2ca97bfe476.dll,#1
  2⤵
  PID:2028

memory/2028-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download