7f0c4f7e794c6937da8a3e80917d522d97964d7f850056f24a15aa35f091b0cd

Analysis

max time kernel
35s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 17:32

Target

7f0c4f7e794c6937da8a3e80917d522d97964d7f850056f24a15aa35f091b0cd.dll
Size

274KB
MD5

52e425b13792d29826a99ae80a61e4b0
SHA1

cb29e0e52ac53fe1b3f110603de10565b8c20714
SHA256

7f0c4f7e794c6937da8a3e80917d522d97964d7f850056f24a15aa35f091b0cd
SHA512

ee91a96f83a13022ac3c37558e2cd36dfe7b66e7ab1ca5073aa1739931ab36717300b779dd42e9cec6fd8ef435987d4727de526cd0e24acf85ec3804d139a18d
SSDEEP

3072:GB9O3kQW1l4SENxHeBTg4vRPo5bN57+XNtUU/c1+jOROj8V87tl+k2doGoEZlBsi:GB9O0jl4vBROj8QYdoJEZfsoqXQwMeu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28
PID 1664 wrote to memory of 1760	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f0c4f7e794c6937da8a3e80917d522d97964d7f850056f24a15aa35f091b0cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f0c4f7e794c6937da8a3e80917d522d97964d7f850056f24a15aa35f091b0cd.dll,#1
  2⤵
  PID:1760

memory/1760-54-0x0000000000000000-mapping.dmp

Download
memory/1760-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1760-56-0x0000000075440000-0x0000000075489000-memory.dmp

Filesize
292KB

Download
memory/1760-58-0x0000000075440000-0x0000000075489000-memory.dmp

Filesize
292KB

Download
memory/1760-57-0x00000000753F0000-0x0000000075439000-memory.dmp

Filesize
292KB

Download