40d2b9edfec112e824a254a44d29733b8e28f4da7b3ac7d58054c313cf1ba442

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 17:34

Target

40d2b9edfec112e824a254a44d29733b8e28f4da7b3ac7d58054c313cf1ba442.dll
Size

184KB
MD5

a3b39cf805d13d02a1677ebc3a7305a0
SHA1

2b540e95dd4a347d4d650e5430810125847f42bb
SHA256

40d2b9edfec112e824a254a44d29733b8e28f4da7b3ac7d58054c313cf1ba442
SHA512

6266547ce5b1e517ca21e4b896afd47a3e47d95ec695d2edb23a54fe455987593125f641cc8e767cab308905e09b60024675b6112d587bdada3623e904b58dae
SSDEEP

1536:skaV4gwyg2FJ38WJN/XstNXtvW50p0fgDj7JNO4WpwjIPAEVhzgx7WJyx:skaNwyLv/ENXtvFpBX9NOtgWAGhzeq+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27
PID 1968 wrote to memory of 1076	1968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d2b9edfec112e824a254a44d29733b8e28f4da7b3ac7d58054c313cf1ba442.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d2b9edfec112e824a254a44d29733b8e28f4da7b3ac7d58054c313cf1ba442.dll,#1
  2⤵
  PID:1076

memory/1076-54-0x0000000000000000-mapping.dmp

Download
memory/1076-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1076-56-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download