66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 00:09

Target

66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e.dll
Size

600KB
MD5

62b8f8ce549584f1a49b4fbad4d3ce00
SHA1

8ab1b24b34a84d70623080de4daa393aab538bf2
SHA256

66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e
SHA512

3ddb7fbd9acabb33b8f0c3820290a295d25cae63be3f15e1415a62b5537cc4c1bce6d82b90163c38509d5198fae9ca22adfb356df5465548389e6f7b73af6152
SSDEEP

12288:DN5Lni72+F+/SvQsGHczF9gaL122xXTXP37vFzbH0nCGtNJvmImuWN:742+JYsVz7wtNFWuu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26
PID 2016 wrote to memory of 1080	2016	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b9af54aeebbe73348302f0ee4069cf37afe6f859525fefdaf158d56ffba25e.dll,#1
  2⤵
  PID:1080

memory/1080-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download
memory/1080-57-0x0000000010000000-0x0000000010097000-memory.dmp

Filesize
604KB

Download