0d9c8445284e80110cc4e5dd2ec757213ce52579d5e652437e4f25e6cbfee470

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 07:49

Target

0d9c8445284e80110cc4e5dd2ec757213ce52579d5e652437e4f25e6cbfee470.dll
Size

93KB
MD5

159fb4017f6e29b9a9287a656ad89310
SHA1

a56bf591364f92be8f20daba81e95b971bea7a91
SHA256

0d9c8445284e80110cc4e5dd2ec757213ce52579d5e652437e4f25e6cbfee470
SHA512

4e4beec018b846179b8c60449fa8856c4f4515c2c04f37b6e1b9e46835de2e1fb95ab5bc687928acfeb83ed8dda7b3ea4b52801cd0fd09a4bea00e2eefcced5c
SSDEEP

1536:Pzj0rTaWtPEC8GSlEUjyY4lRDUNbFD1d0VyyVeS064ocUXa6b+u7qqONy0u6Ig/i:7jHgPXSljyY42mVykPNXa6C+POy6PHq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9c8445284e80110cc4e5dd2ec757213ce52579d5e652437e4f25e6cbfee470.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9c8445284e80110cc4e5dd2ec757213ce52579d5e652437e4f25e6cbfee470.dll,#1
  2⤵
  PID:628

memory/628-54-0x0000000000000000-mapping.dmp

Download
memory/628-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download