90a1d154c53837741d9f804af94d46e5d80d13fe8e3e62ca771aa1de69d43e4b

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 07:49

Target

90a1d154c53837741d9f804af94d46e5d80d13fe8e3e62ca771aa1de69d43e4b.dll
Size

905KB
MD5

6770bf49c8cdb7766aad82dbb6634d40
SHA1

32eb143bddbb070853ca962571ffe984551d7707
SHA256

90a1d154c53837741d9f804af94d46e5d80d13fe8e3e62ca771aa1de69d43e4b
SHA512

db45906b0afeadabac8a4cbba3eb607c3722bf9bb4451347b248da9802a62bb8a90adf127a1fa9c7975dae902fda69c73c716069d569c152e08207c1310cdfd6
SSDEEP

24576:LlKshZvaO6HgIxrmlmWT9HeX/WJ+QY304Pus92YtZH/:LYshZSO2tmlPhHUjZP19dj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 944	1700	rundll32.exe	27
PID 1700 wrote to memory of 944	1700	rundll32.exe	27
PID 1700 wrote to memory of 944	1700	rundll32.exe	27
PID 1700 wrote to memory of 944	1700	rundll32.exe	27
PID 1700 wrote to memory of 944	1700	rundll32.exe	27
PID 1700 wrote to memory of 944	1700	rundll32.exe	27
PID 1700 wrote to memory of 944	1700	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a1d154c53837741d9f804af94d46e5d80d13fe8e3e62ca771aa1de69d43e4b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\90a1d154c53837741d9f804af94d46e5d80d13fe8e3e62ca771aa1de69d43e4b.dll,#1
  2⤵
  PID:944

memory/944-54-0x0000000000000000-mapping.dmp

Download
memory/944-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/944-56-0x0000000001E20000-0x00000000020D0000-memory.dmp

Filesize
2.7MB

Download
memory/944-57-0x0000000001E20000-0x00000000020D0000-memory.dmp

Filesize
2.7MB

Download
memory/944-58-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download