793b0f4919605228354d56390ba3c71e1e541eece0795cefef28f75ba3e9a9fd

Analysis

max time kernel
30s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 10:43

Target

793b0f4919605228354d56390ba3c71e1e541eece0795cefef28f75ba3e9a9fd.dll
Size

5KB
MD5

900c152d8c581480eb744a9781cce570
SHA1

4793f44fc9fdb0c9f48b447401f554d1cbdceab2
SHA256

793b0f4919605228354d56390ba3c71e1e541eece0795cefef28f75ba3e9a9fd
SHA512

ce3f4b3e1f3739da9e5de6f8da876c043d097f2b2e6891e42a55f4d9500c0520fef01eed1f24aff7f8f2586776edc73222db8af8a239d157401d2fef15918566
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXr0BoYC:1h9jTqMMrY0OI/KYyznSM/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\793b0f4919605228354d56390ba3c71e1e541eece0795cefef28f75ba3e9a9fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\793b0f4919605228354d56390ba3c71e1e541eece0795cefef28f75ba3e9a9fd.dll,#1
  2⤵
  PID:1976

memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1976-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download