1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 02:22

Target

1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192.dll
Size

267KB
MD5

5385f6ad16ba53d984cf89aa0d796d97
SHA1

7d3bb0301362ffcf9885dc8c161fd246444bcb21
SHA256

1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192
SHA512

3ddf78cd9a34a3f761031305300f4e36a60a4e25901b195591980aa190d77fca58fef14a70eb034a4d363690984877b7cfe85ec9615c35e9c4cdfe4bb2fb25ff
SSDEEP

6144:Zn46wsJIrCCwVwette322cmfGSwk/Nj1uni:Z463J2KCLOS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27
PID 1760 wrote to memory of 1252	1760	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c252ca82f48f1e3f85b9317781891245e69d2d66b90600b904ce96431e37192.dll,#1
  2⤵
  PID:1252

memory/1252-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1252-56-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1252-57-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1252-58-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1252-59-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download