68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 20:43

Target

68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll
Size

343KB
MD5

664d6e7b21d44375d158d70548f35cbe
SHA1

d2734b774b18c6aefb2c420fafbf2cf8c7997a96
SHA256

68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee
SHA512

08915f8c3055a4db327ba553614090661b5467cd0a5c929895bea0988fbc4775a5b5a9723732fe266913551d43924f0a0a0d1159cab1594d00fd78c83c3959fa
SSDEEP

3072:R/+JR2BNtlt0ntfjNOVzV5kqTX0nj5XEAprAgSJUJP28ZulWsXbds:R/+JR2BNtlt0trN1nhEApkggqPHZLZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27
PID 2008 wrote to memory of 1072	2008	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68dd3e1bea2de05dd308717f0d0199ce3516ab1ec2e7a1fe710158f9ae6d6fee.dll,#1
  2⤵
  PID:1072

memory/1072-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1072-56-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download