caf02bd60f22e21c83cff2bf1e512860db24239849c02e409934393c06d8a459

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 10:01

Target

caf02bd60f22e21c83cff2bf1e512860db24239849c02e409934393c06d8a459.dll
Size

4KB
MD5

1517723720ffe5e7ebae982b99e3a6c0
SHA1

377d37a0f50d3a09055ebb4d6f298cc950b1606a
SHA256

caf02bd60f22e21c83cff2bf1e512860db24239849c02e409934393c06d8a459
SHA512

4a195e3bb42af9333a9eb5157ef11eae927d1c6baffd67ed54dfb554b4910f2b3d916f418b921edb8071f7bf987801a821d1ad0e82826908de211c305f6f3649
SSDEEP

48:a5zjMTGcITBVQVE1lcvgtiyccyzaf7KbPCcJRpJKv:iT3Qu8vQN8o7w6UhKv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28
PID 1932 wrote to memory of 1460	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\caf02bd60f22e21c83cff2bf1e512860db24239849c02e409934393c06d8a459.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\caf02bd60f22e21c83cff2bf1e512860db24239849c02e409934393c06d8a459.dll,#1
  2⤵
  PID:1460

memory/1460-54-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download