deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b

Analysis

max time kernel
10s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 23:36

Target

deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b.dll
Size

131KB
MD5

360878e59c45ad57c10af93e5cf9715c
SHA1

86f24346f6249101049c7a59a645ff8ab9dea189
SHA256

deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b
SHA512

ad7456ff2cb73fa0d4163991883dd0d59848facf48159342bb0d46060294aba6031eb3a3453049b1408f1fd33e91478d8873d8007bc10c0b0129ff78cd9e1609
SSDEEP

3072:aqUQkfRw82e3jX4qVIFPo5H0Nyeg0a2IjzHtF9j5:L4Rag2FPo5HegR2IjzD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b.dll,#1
  2⤵
  PID:1976

memory/1976-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download