c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7

Analysis

max time kernel
6s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:19

Target

c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7.dll
Size

80KB
MD5

68c980362a27b44d34a11c57835cfd30
SHA1

ec90cd14332b6e87fd23c7fdc1e3fe1902b6fa5c
SHA256

c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7
SHA512

e663595377f528e3f239680135f12b120142cb8141210b8f46866b2d6edd9cc0f9d6fdfcf043eb6e0fcacf111db06b86c68e2e922e724d4a40e850fb7c710d9b
SSDEEP

768:+K9/lxL3inlX43pw4lZSJN6BRdZ2NHB9UKP+C4NoBQfdHvNkk:flxrYlI3p9grW5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 536	1780	rundll32.exe	28
PID 1780 wrote to memory of 536	1780	rundll32.exe	28
PID 1780 wrote to memory of 536	1780	rundll32.exe	28
PID 1780 wrote to memory of 536	1780	rundll32.exe	28
PID 1780 wrote to memory of 536	1780	rundll32.exe	28
PID 1780 wrote to memory of 536	1780	rundll32.exe	28
PID 1780 wrote to memory of 536	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7.dll,#1
  2⤵
  PID:536

memory/536-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/536-56-0x0000000020000000-0x000000002001A000-memory.dmp

Filesize
104KB

Download