628c384fb5fdd61f3496cd1ebc0ceb1be5ac574066d68def70610e435ee9e49a

Analysis

max time kernel
42s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 21:25

Target

628c384fb5fdd61f3496cd1ebc0ceb1be5ac574066d68def70610e435ee9e49a.dll
Size

61KB
MD5

7a57f3ec95d9ef0ab615204021f996a8
SHA1

0b55332a4821c3327ad40859e5648b2af8c9cb15
SHA256

628c384fb5fdd61f3496cd1ebc0ceb1be5ac574066d68def70610e435ee9e49a
SHA512

0fd65f3fbee3ccd47bac80fc65e571eab1844ebbf4975103c6e992ee1964789d14923cf846e2e1465613161cb1fce61a0bcbc06f1204d6d7862faf4b055ca7da
SSDEEP

1536:OPefh5SrZxCS52aeFKl7bMOz5hnIwzYVmcsdR:OPefh0rDCSk6lH3IYYVmcsdR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28
PID 832 wrote to memory of 1692	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\628c384fb5fdd61f3496cd1ebc0ceb1be5ac574066d68def70610e435ee9e49a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\628c384fb5fdd61f3496cd1ebc0ceb1be5ac574066d68def70610e435ee9e49a.dll,#1
  2⤵
  PID:1692

memory/1692-54-0x0000000000000000-mapping.dmp

Download
memory/1692-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1692-56-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download