d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 00:36

Target

d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5.dll
Size

144KB
MD5

6fa382c36fde4920cabed17352bfb4a8
SHA1

a0a66f0dea61038d6ae0a798d61f731f2ecc5af1
SHA256

d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5
SHA512

d2704bd61673ec957ec2bb75667cdd21d2b1fa740ffb12fa5c39a57831ebe9d73bd983dd838d67651d847c4cd8e277104e92019288baa4ac55772e19416510e7
SSDEEP

1536:/IcMIlIjkuvfZ/AuwHPNAnlFdyqcgzjNaASP0xOePV8AgH:/ey8xvfGH2RQJ0xO48Ag

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27
PID 1488 wrote to memory of 1940	1488	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d9c77738e310814de6d50a3023106951c5b443f637c7e306dce7341adca313a5.dll,#1
  2⤵
  PID:1940

memory/1940-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download