e8cb7a92c69613896c4821b0c6cfa69dd410d6d02563eda9d8cd3e937c1dacde

Analysis

max time kernel
46s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-09-2022 06:26

Target

e8cb7a92c69613896c4821b0c6cfa69dd410d6d02563eda9d8cd3e937c1dacde.dll
Size

116KB
MD5

dc247a0f60e44843a252db275bb94322
SHA1

932c7163ab5235797fed0e7bdeb26b2672ed55ba
SHA256

e8cb7a92c69613896c4821b0c6cfa69dd410d6d02563eda9d8cd3e937c1dacde
SHA512

6119647986a57a882de75ef2002ce4613d03447a8a962d908a4e6463a9b94a04c47e6f025de30796a2279d8f2f5df10319c9d248dba903875a4413db9d2302bd
SSDEEP

3072:F38mCe4rNu+VVdTMe64/Oi27RqRJNoriBwu8WDJJxx:NCT5d4dUOibfqcx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28
PID 1764 wrote to memory of 1956	1764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8cb7a92c69613896c4821b0c6cfa69dd410d6d02563eda9d8cd3e937c1dacde.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8cb7a92c69613896c4821b0c6cfa69dd410d6d02563eda9d8cd3e937c1dacde.dll,#1
  2⤵
  PID:1956

memory/1956-54-0x0000000000000000-mapping.dmp

Download
memory/1956-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download