e1a96683df71dd5f21311792e24eaebf78e37d05b8248ba655f68be01038457e

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 05:11

Target

e1a96683df71dd5f21311792e24eaebf78e37d05b8248ba655f68be01038457e.dll
Size

612KB
MD5

4c135164ab221e6cfd8290800578432f
SHA1

bfdf17d55112c9b331a442f44c0a1b3a95bf3859
SHA256

e1a96683df71dd5f21311792e24eaebf78e37d05b8248ba655f68be01038457e
SHA512

35822292fb8a3e9535a571d68a899803136da15eeb72d11dfa1822abdf1b50054ffe8de6d10596fee37e4a7827e18471f670b63822cd9851126187550b541368
SSDEEP

12288:2U5GLE0kuGnESBW+8H9u6vRHO/UUCruWVz/:2U4MtnES78HPuWVz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe
PID 1324 wrote to memory of 1808	1324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1a96683df71dd5f21311792e24eaebf78e37d05b8248ba655f68be01038457e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1a96683df71dd5f21311792e24eaebf78e37d05b8248ba655f68be01038457e.dll,#1
2⤵
PID:1808

memory/1808-54-0x0000000000000000-mapping.dmp

Download
memory/1808-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1808-56-0x0000000000290000-0x0000000000329000-memory.dmp

Filesize
612KB

Download