774c42136b54d7d91fac186505ad823f6771e475eba05dbdf272f89678776e6d

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 20:38

Target

774c42136b54d7d91fac186505ad823f6771e475eba05dbdf272f89678776e6d.dll
Size

64KB
MD5

63db0662796de6056de0ef9484f0e94e
SHA1

c93e81d4e8e7c2bd9c158727632d53f448b8f61a
SHA256

774c42136b54d7d91fac186505ad823f6771e475eba05dbdf272f89678776e6d
SHA512

def90ee53a27ac53b17077c044fbd04ee8dd2f0515193801b6c4a172aa39e2a42410649d416d8818290ab347f2961e19bec6cde4d10f0845843f434ca88ba443
SSDEEP

1536:Bm1NGJVGMDbuYICBhqloRBiiqGnv701vWW789:kX0VlfdIE4eii3nv7eWs89

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27
PID 112 wrote to memory of 1472	112	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\774c42136b54d7d91fac186505ad823f6771e475eba05dbdf272f89678776e6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\774c42136b54d7d91fac186505ad823f6771e475eba05dbdf272f89678776e6d.dll,#1
  2⤵
  PID:1472

memory/1472-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download