9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050

Analysis

max time kernel
32s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 14:05

Target

9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050.dll
Size

30KB
MD5

962e33d32797cfb6681ca349f3b09b2e
SHA1

a22e677cb54b10ff5e686e319d3bf7dae6a783d1
SHA256

9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050
SHA512

64509e1b63b49596d09da839dc694b5dbcf3aa0316df13e901560f0a058667b9dad57dc579d90b6f00d9e9d56baf335d744f0018033f9456573261d4d2554a5e
SSDEEP

384:IDJs5yqusFWtRCcH4DcjZGsXVVbRKdPg0uQEuwb5rKgKMKJCmkLv3jPH/OfGlSTB:IQuss8efsub83LJC33jOfOSPVK

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28
PID 2012 wrote to memory of 1992	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9906bdb1da39bc67066cf56ccb4d3a1ed19af36f22d11efd831ecd2d57437050.dll,#1
  2⤵
  PID:1992

memory/1992-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download