4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 04:18

Target

4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea.dll
Size

65KB
MD5

147c28afc51ab8cc08c58c5703e90ada
SHA1

4b807eafee5c4de2a916b473def2fa1dce1e222d
SHA256

4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea
SHA512

a6a5508fc7ecd2ba7f65e72cb6bbc99f4ba0f1d308d93c8c2b2c0664de12256c06cc1da3c976cf11c84701236e53297694c91f3ede6792a62f874b683ad8fec6
SSDEEP

1536:Zwoq+LsVXPstyxi+16pBpaVUCUFrtFn64qx:ON+oVXEExEbpaVUPBtF6Jx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27
PID 1128 wrote to memory of 1116	1128	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea.dll,#1
  2⤵
  PID:1116

memory/1116-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1116-56-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1116-57-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1116-58-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download