77f9648b38b79bfd27008539e218920a4c6fb99f887b898f9ecf01cd52ef7624

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 16:27

Target

77f9648b38b79bfd27008539e218920a4c6fb99f887b898f9ecf01cd52ef7624.dll
Size

60KB
MD5

392ffa844de9b043d9d33689dade3289
SHA1

a9df1e98e9733d62facd47f36f0b208c9ed81497
SHA256

77f9648b38b79bfd27008539e218920a4c6fb99f887b898f9ecf01cd52ef7624
SHA512

274193a23013c54b66f211b0b45a5f5a53f76655cb8ddd4d632759e18034386c1006134ee0e897cb357973c4f1cfc02105365fcfd0f5d2655631b582cb98ea7a
SSDEEP

1536:u6u/1YpyFuO/+UyjjvAhIX59iyF6/ED2OOvh:u6u9YkB/+LFX5FFKjOWh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77f9648b38b79bfd27008539e218920a4c6fb99f887b898f9ecf01cd52ef7624.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77f9648b38b79bfd27008539e218920a4c6fb99f887b898f9ecf01cd52ef7624.dll,#1
  2⤵
  PID:828

memory/828-54-0x0000000000000000-mapping.dmp

Download
memory/828-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/828-56-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/828-57-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download