67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 21:12

Target

67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448.dll
Size

42KB
MD5

b44052d3577512a8b6c6301958b3a58c
SHA1

eb5a3d5e398a99239c9177aa3e0410493b4dea5a
SHA256

67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448
SHA512

2201b4aa3eb179a9f9282d9ae95044c78c746ba0ae743f1719596257f22ee6fc895dc90ba2ce459ca7104c7a9780ebf7a7c8af11c716c7bd4aa9967a372f4a6a
SSDEEP

768:B0cz/iE+YFLZ1QoTgxdu7ZIUInoEv4zrNffXGU2k1/+SJOydXm1o9Iv:HCYP2oPyUrEvAJ9V1/+6h2o2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27
PID 1416 wrote to memory of 1224	1416	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448.dll,#1
  2⤵
  PID:1224

memory/1224-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-56-0x0000000001DF0000-0x0000000001EC6000-memory.dmp

Filesize
856KB

Download