f22378e77cf2d65acf837c659c0b2ad832abc34d85b45a75a28f38b222cea10d

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:02

Target

f22378e77cf2d65acf837c659c0b2ad832abc34d85b45a75a28f38b222cea10d.dll
Size

525KB
MD5

04595140f4d4bcd7a08a5f056e306781
SHA1

2cdfcce6d616e0e5cad30d51e8ff1de85b2bd155
SHA256

f22378e77cf2d65acf837c659c0b2ad832abc34d85b45a75a28f38b222cea10d
SHA512

7a7951b8601295766542485675f119ccd656eba52839bd21e9d0c75af9f7982febf2ce5c8b73cbbfdb22b55e49e6635709c14edf0f6bb0d578e28d4e51a784a7
SSDEEP

6144:vZO9/vgsGreXyyU+Bkm9eDFgZcnednwfRHBSnRzmrN9dt/IioJvtve02cTBj7nnw:QJFtyyPBEmdnAGmJ9dFFUtve02cTlnw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28
PID 1832 wrote to memory of 1688	1832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f22378e77cf2d65acf837c659c0b2ad832abc34d85b45a75a28f38b222cea10d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f22378e77cf2d65acf837c659c0b2ad832abc34d85b45a75a28f38b222cea10d.dll,#1
  2⤵
  PID:1688

memory/1688-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1688-56-0x0000000000720000-0x00000000007AB000-memory.dmp

Filesize
556KB

Download