1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 15:56

Target

1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717.dll
Size

100KB
MD5

91094dee405cfae28385ee253102462e
SHA1

357fa9ea147c5f599096d69c5c45e8726072cfc2
SHA256

1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717
SHA512

a024739259e5f6a264d68c901817fb4a6c730b84db63089877ad301a56b3452dcf98dba45bcac30504dd11e3f770d1685cd9c3e61cc7edae8c47f0213a8a28a2
SSDEEP

1536:Zn4Mi33LS7enDxBZvM2ldyYvJtokfIvi6Mg+/ItxfG0Z+1EI/:Zfi3b8enD3WKJJfn6W/Iv8/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27
PID 1328 wrote to memory of 1196	1328	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3cac753c5ff248333fe1bf12b9879848d2ecdecb569267cbaf092985cbc717.dll,#1
  2⤵
  PID:1196

memory/1196-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download