923793b5ebd17ef82d44d152c1f34b0010f366a8ee84a41d86dd7ad4ecf6e153

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 06:49

Target

wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.22621.1_none_59a0c10b9934ff9d_msvcp110_win.dll
Size

408KB
MD5

f91e3f8ef242c9f0bdf837d07aab797f
SHA1

5069aad45e2c2ad88bfe6c455a2b9969660183c3
SHA256

6ed71a6689f3ce0de57fa3b2179767264917f3329d462e5c9f78816a3f331664
SHA512

d36e0578ffe6619bcc781965bc3077d15aa49ee9cf9edfd4487022ddf4578db2ba722920993120f2477609c1a6a7bb71b8f875e83e0f8b0fe92891489c1bb645
SSDEEP

12288:qWUDzopINU2lFnQ9I3HijHhUgiW6QR7t5sa3Ooc8fHkC2e/Hq8T:qW5pINU2lFnWI3HiIa3Ooc8fHkC2e/HP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28
PID 2020 wrote to memory of 1968	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.22621.1_none_59a0c10b9934ff9d_msvcp110_win.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wow64_microsoft-windows-msvcp110_31bf3856ad364e35_10.0.22621.1_none_59a0c10b9934ff9d_msvcp110_win.dll,#1
  2⤵
  PID:1968

memory/1968-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download