c9f7248e64b531031822e3cda468bf52fcfe169ad15d7d8ddf379cb27ad8b63b

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-09-2022 06:02

Target

c9f7248e64b531031822e3cda468bf52fcfe169ad15d7d8ddf379cb27ad8b63b.dll
Size

88KB
MD5

58461ef637edb4c156713b01539a11d1
SHA1

b6b41868958f89f58d6d84a2995c1ee7b7cbc125
SHA256

c9f7248e64b531031822e3cda468bf52fcfe169ad15d7d8ddf379cb27ad8b63b
SHA512

5dbf11224f3730d056ddba40ce88094a2ce3aff42e75dea30bf3132eed0a0223a6b3b7dbae21499525478f39e762b264896799d6785ba3b0e1ad4d534bd8747e
SSDEEP

1536:0HkNYNt+HUqldv1nIoq1ogn+crceQO25J6iynsWjcd39PP8:0Hj+nlbnIouxQO25aI39PP8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe
PID 1912 wrote to memory of 1896	1912	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9f7248e64b531031822e3cda468bf52fcfe169ad15d7d8ddf379cb27ad8b63b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9f7248e64b531031822e3cda468bf52fcfe169ad15d7d8ddf379cb27ad8b63b.dll,#1
2⤵
PID:1896

memory/1896-54-0x0000000000000000-mapping.dmp

Download
memory/1896-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download