2fd01934d0173cf2c842ad888008c4a5279aff70ddefb76faaf72821f862494b

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 04:24

Target

2fd01934d0173cf2c842ad888008c4a5279aff70ddefb76faaf72821f862494b.dll
Size

340KB
MD5

4478068f475c95dac213969ed5b7c040
SHA1

7f0dd7d7a1501142d437b17b495224d0ce06c3d8
SHA256

2fd01934d0173cf2c842ad888008c4a5279aff70ddefb76faaf72821f862494b
SHA512

c243bfc8b022aac6477f3b239bf142bebc01beb842e14a42642b9b136da8c84b65a7aa4672f23bc59472b2cec6d0179aa343326d0b4a954107a13b1bb86d41f7
SSDEEP

6144:IfY87wsXS07IMG++5SrbXy/OQRtqj4YB4K0DBI9NclLZ4ocKPQv335oS:VtsxQuJQRtqjb43eclLap1RoS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28
PID 896 wrote to memory of 1952	896	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd01934d0173cf2c842ad888008c4a5279aff70ddefb76faaf72821f862494b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd01934d0173cf2c842ad888008c4a5279aff70ddefb76faaf72821f862494b.dll,#1
  2⤵
  PID:1952

memory/1952-54-0x0000000000000000-mapping.dmp

Download
memory/1952-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download