e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea

Resubmissions

13-10-2022 14:58

24-01-2022 00:49

max time kernel
2s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 14:58

Target

e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll
Size

164KB
MD5

cfefcc2edc5c54c74b76e7d1d29e69b2
SHA1

7423c57db390def08154b77e2b5e043d92d320c7
SHA256

e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea
SHA512

62d16f32a1c7d1063aa092a418555bd979f43367310f4ea4cd2eadd4edf4bbde474401980281d3d1fe3788245a25bab8280ce1ac1ffd83eee0ed38f026ececfd
SSDEEP

3072:efufigrn2u3DsLEai2XGmSQEjv5TpF+OjN57YHONxUrtUYU/99:efufJ28DSRi2W5jh7xz78O//

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1964	1324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e430479d1ca03a1bc5414e28f6cdbb301939c4c95547492cdbe27b0a123344ea.dll,#1
2⤵
PID:1964

memory/1964-54-0x0000000000000000-mapping.dmp

Download
memory/1964-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1964-58-0x0000000003010000-0x000000000313D000-memory.dmp

Filesize
1.2MB

Download
memory/1964-59-0x0000000000540000-0x000000000055F000-memory.dmp

Filesize
124KB

Download
memory/1964-60-0x0000000003440000-0x0000000003549000-memory.dmp

Filesize
1.0MB

Download
memory/1964-61-0x0000000000120000-0x000000000012A000-memory.dmp

Filesize
40KB

Download
memory/1964-62-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download