9c151ee23b5de07f8c99e8d5d2bfb0c6ab73a6eaf241d631d2c7c893c38ce8dc

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 07:04

Target

9c151ee23b5de07f8c99e8d5d2bfb0c6ab73a6eaf241d631d2c7c893c38ce8dc.dll
Size

363KB
MD5

6cb4d36180ba94a273e0594a50be1c5f
SHA1

771631a1b8d95a2427c5cc3644b54f6b4d4ab8f9
SHA256

9c151ee23b5de07f8c99e8d5d2bfb0c6ab73a6eaf241d631d2c7c893c38ce8dc
SHA512

523166fc5ba1f6b2cb4658f8e0e00ee825e4e5f4e3c79aec5eeb7c5a3b06054f2a13a3b631363e47d65567234e5c63a2065902310c4a7c52d7bcfaeacafc1715
SSDEEP

6144:RwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:ykI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c151ee23b5de07f8c99e8d5d2bfb0c6ab73a6eaf241d631d2c7c893c38ce8dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c151ee23b5de07f8c99e8d5d2bfb0c6ab73a6eaf241d631d2c7c893c38ce8dc.dll,#1
  2⤵
  PID:1976

memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1976-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000073E70000-0x0000000073ECE000-memory.dmp

Filesize
376KB

Download
memory/1976-57-0x0000000073E71000-0x0000000073EC6000-memory.dmp

Filesize
340KB

Download
memory/1976-58-0x0000000073E70000-0x0000000073ECE000-memory.dmp

Filesize
376KB

Download
memory/1976-59-0x0000000073E70000-0x0000000073ECE000-memory.dmp

Filesize
376KB

Download