4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a

Analysis

max time kernel
33s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 13:35

Target

4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a.dll
Size

32KB
MD5

6c4d239c7e3c9da511c51506c03bce06
SHA1

ba4322b582d796292d27bea308341ff457646c23
SHA256

4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a
SHA512

68652231fcd061b17b424615c37c9e9613b57d668ed5e233cb790daedb71b5a0afe90f9b3402812d11fe02c9fdc20458922b7d56bec1f4fb99deafe1f0d74671
SSDEEP

768:bN/CMPCo5t+dOpk7Vz7LPT1IShVD8R96HZVz:bN/CMPCA4Oe57LrXHAR+Z9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28
PID 1004 wrote to memory of 1212	1004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c604680e8c35865c73d1738a4db843646cc03687a3c02a9470f76e15c10710a.dll,#1
  2⤵
  PID:1212

memory/1212-54-0x0000000000000000-mapping.dmp

Download
memory/1212-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download