3002dd00c45b86468ba99c79e0da3437579f7d1f8cc04ae001e3ef0b73c2e247

Analysis

max time kernel
47s
max time network
96s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 08:06

Target

3002dd00c45b86468ba99c79e0da3437579f7d1f8cc04ae001e3ef0b73c2e247.dll
Size

42KB
MD5

6927519baeafeb8db9ad7e342217c540
SHA1

3dfbc1aef96821a7ffd96e88480ab76eda4e262f
SHA256

3002dd00c45b86468ba99c79e0da3437579f7d1f8cc04ae001e3ef0b73c2e247
SHA512

1f0f49b36bafd01034027db13235caf9ee34a855c45f60e0c1fd022bf2728c5f9e3285a9c3e44899999b84d2ef65d28a2e631c2e517cee73395a4792d75198a4
SSDEEP

768:09f+1r7ODppq2LCeXCST7hq1r1XNNkJbX4NKdb2wyra1o94x2:qfmyDp4mCCJ3s1r1XNGX44t23Yom

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27
PID 2020 wrote to memory of 2044	2020	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3002dd00c45b86468ba99c79e0da3437579f7d1f8cc04ae001e3ef0b73c2e247.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3002dd00c45b86468ba99c79e0da3437579f7d1f8cc04ae001e3ef0b73c2e247.dll,#1
  2⤵
  PID:2044

memory/2044-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000000900000-0x00000000009D6000-memory.dmp

Filesize
856KB

Download