2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c

Analysis

max time kernel
13s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 06:39

Target

2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c.dll
Size

9KB
MD5

4305c2ed1f3111f53b47b8c7f6e0a20f
SHA1

cb78e3937642530b855962d2f3397981f74d3f7a
SHA256

2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c
SHA512

580e2493ead510a6e96a2416d075c0a23d8bcf1029f153ab4030d9717160b6faabd90bce0fa1d4ceb34737d223624200469449da3a172c1a8c4c3721591068fc
SSDEEP

192:Iw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w97:4dHad/N20IypWak8dWiWak8EdWM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27
PID 1928 wrote to memory of 1048	1928	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2900db59d2bc0e75f24d47c9fb99ff8dbcddbc9646422a57f058c12dce76a76c.dll,#1
  2⤵
  PID:1048

memory/1048-54-0x0000000000000000-mapping.dmp

Download
memory/1048-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1048-56-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download