d91a3481c81807a97259db7e9863450771554700452e13741fb0e1bc79296eb4

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 00:11

Target

d91a3481c81807a97259db7e9863450771554700452e13741fb0e1bc79296eb4.dll
Size

232KB
MD5

79778f538918fb3bc9d4fd17a4593706
SHA1

e269ddfbd0c1939dd498c961163125e06bd02e95
SHA256

d91a3481c81807a97259db7e9863450771554700452e13741fb0e1bc79296eb4
SHA512

a70c90b64c346fd7856e7d3be30822f3e96891b174cabbc33a63030f8df5ed651c4532b9f51d3f72a1527e3b4a843fd73fcadcfb22cbbb1f24a3d99bafe3255c
SSDEEP

3072:5yv5nJL+eEfftySI3AY1QayvwxjJBLiuw2do8LUTncp9lsZzikC/bpijhw:i6XtrOt5Jxfw2dHLUIpDCzi5ijm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d91a3481c81807a97259db7e9863450771554700452e13741fb0e1bc79296eb4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d91a3481c81807a97259db7e9863450771554700452e13741fb0e1bc79296eb4.dll,#1
  2⤵
  PID:788

memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/788-56-0x000000001FEB0000-0x000000001FEEA000-memory.dmp

Filesize
232KB

Download
memory/788-57-0x000000001FEB0000-0x000000001FEEA000-memory.dmp

Filesize
232KB

Download