590982ee33e0427e8c0fd667ea7ef51663812c5354db161cd13b713106e9eaea

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 06:39

Target

590982ee33e0427e8c0fd667ea7ef51663812c5354db161cd13b713106e9eaea.dll
Size

10KB
MD5

4563845cc7324942641478c0ceb4abe5
SHA1

31ad166a61e8e5e1ba3c3dd2da379343ee7b6ad4
SHA256

590982ee33e0427e8c0fd667ea7ef51663812c5354db161cd13b713106e9eaea
SHA512

1d38b9c7f3accfa2b878ac768f504ebb9db531eb5d6999d485919f31432e662ef04b63a5f102e652ba9f0f88f9fd6681f288ea13edc678ffa6f7f09b9004ab7b
SSDEEP

192:41mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o92b:48jhdHad/z20IyFWakC84dWaWak8cdWj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27
PID 1308 wrote to memory of 1356	1308	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\590982ee33e0427e8c0fd667ea7ef51663812c5354db161cd13b713106e9eaea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\590982ee33e0427e8c0fd667ea7ef51663812c5354db161cd13b713106e9eaea.dll,#1
  2⤵
  PID:1356

memory/1356-54-0x0000000000000000-mapping.dmp

Download
memory/1356-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1356-56-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download