8c64e451cda4808545e9add1f903b64ecffc864c0cb85126d16e8dc2fab3d040

Analysis

max time kernel
41s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 07:23

Target

8c64e451cda4808545e9add1f903b64ecffc864c0cb85126d16e8dc2fab3d040.dll
Size

1004KB
MD5

6e8c39aa7ed4e3c5ba71e2958880d48f
SHA1

4d4c5f2b81dd6ce3f4d35403c5bd74a97aa3e95a
SHA256

8c64e451cda4808545e9add1f903b64ecffc864c0cb85126d16e8dc2fab3d040
SHA512

854b509c7f1fc0115b4c80ebf5d67481436ad95c9dee81d48a2f420e40a3dfe9356f0cba1952ac730d723ecc3496f8951d35b44dd119eb76b0eefb1f347723c4
SSDEEP

24576:U5gCgaRCGXLE9ifgJoUMlpxNFAYgJmY9qINeYYYYKUISCgH/wm:yg5aRCCngY2qINeYYYYwFgHom

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 852	1396	rundll32.exe	27
PID 1396 wrote to memory of 852	1396	rundll32.exe	27
PID 1396 wrote to memory of 852	1396	rundll32.exe	27
PID 1396 wrote to memory of 852	1396	rundll32.exe	27
PID 1396 wrote to memory of 852	1396	rundll32.exe	27
PID 1396 wrote to memory of 852	1396	rundll32.exe	27
PID 1396 wrote to memory of 852	1396	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c64e451cda4808545e9add1f903b64ecffc864c0cb85126d16e8dc2fab3d040.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c64e451cda4808545e9add1f903b64ecffc864c0cb85126d16e8dc2fab3d040.dll,#1
  2⤵
  PID:852

memory/852-54-0x0000000000000000-mapping.dmp

Download
memory/852-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x0000000010000000-0x000000001015C000-memory.dmp

Filesize
1.4MB

Download