979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 15:30

Target

979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5.dll
Size

18KB
MD5

968ba226e2249f8fa382f9852c2e4380
SHA1

d255ed93393e10fff6a48f2689de0727f47b1b4d
SHA256

979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5
SHA512

9f5fb7519d7f3cc7f12e439bb22668c65a090563a60379fc2563fb36c3cede0d2d10179121ef400b9b57dd5c649c16984bbe446161550e78d86d501df9467c6a
SSDEEP

384:9uCiGC+GoC37M6F0yWqYkD68PyR+zCru60viv0U:9ZiO27MUWXkvyR++ruXv+R

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28
PID 1780 wrote to memory of 2028	1780	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\979f769af001cac705174207a15e5dac3ba924a04ecf2913c7464b7fc73d05c5.dll,#1
  2⤵
  PID:2028

memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2028-57-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2028-58-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2028-59-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download
memory/2028-60-0x00000000001F0000-0x0000000000230000-memory.dmp

Filesize
256KB

Download