0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 02:27

Target

0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e.dll
Size

10KB
MD5

6c84118c7b8dd3e784a3c1124865b287
SHA1

2854038cad6cd8bb4fed894517b70769e4518a46
SHA256

0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e
SHA512

9e281fe7bb52f8af7932472d6f390a5459c2945c3abe4c372f2c13c20be0fa27a425caf8bb798451800cc1bd3323853af17be2e2f2dd56a83de85f9d4254fc99
SSDEEP

192:Sw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w92b:6dHad/N20IypWak8dWiWak8EdW7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26
PID 1248 wrote to memory of 1120	1248	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0036bb88b8f74c5a9e2395ff5971500ec5aa4a6a21bafc7de790d2523769ec5e.dll,#1
  2⤵
  PID:1120

memory/1120-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1120-56-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download