369a7a940e1bac3bbcd9576813924bfb31526cc4fea10af9c210fa97f3803e36

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 20:04

Target

369a7a940e1bac3bbcd9576813924bfb31526cc4fea10af9c210fa97f3803e36.dll
Size

67KB
MD5

57ff3158de25c78ee167ed4d25981810
SHA1

fa0e32653908887e9c8c37bc981cbc216e686018
SHA256

369a7a940e1bac3bbcd9576813924bfb31526cc4fea10af9c210fa97f3803e36
SHA512

5abbe33d06fdbbfec9fa2dacd33eb54cd354a6fe8428a54969c267533d877614d019353244e0bfe983e4e1c6d82b7922130a2ee9fd415a911dfcb17975fbdfcb
SSDEEP

1536:Bm1NGJVGqWl8gjMvz2ZwnswknpLYb05IOAPVU222WF:kX0VHmMvzdPk95IOAP9WF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1740	916	rundll32.exe	28
PID 916 wrote to memory of 1740	916	rundll32.exe	28
PID 916 wrote to memory of 1740	916	rundll32.exe	28
PID 916 wrote to memory of 1740	916	rundll32.exe	28
PID 916 wrote to memory of 1740	916	rundll32.exe	28
PID 916 wrote to memory of 1740	916	rundll32.exe	28
PID 916 wrote to memory of 1740	916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\369a7a940e1bac3bbcd9576813924bfb31526cc4fea10af9c210fa97f3803e36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\369a7a940e1bac3bbcd9576813924bfb31526cc4fea10af9c210fa97f3803e36.dll,#1
  2⤵
  PID:1740

memory/1740-55-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download