4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 20:40

Target

4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db.dll
Size

216KB
MD5

8434ce8f4ffe1403e613a171c861909c
SHA1

bc6151ff4b211ccb58210f24a22673ade8930e39
SHA256

4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db
SHA512

b90bdbb76d4ce9508797402ee8c349cd779ccc645fc4500886986af945fee788575e14e8bbb7206fa95bbbe8b260df009a892144b420be7da08db90ee5f8008e
SSDEEP

3072:ETL3VCQxJ/VzlkMS9nfcmHs7Qg/cBW3iomZfCK1WWkTRiMqqDa/0tCL:ETLdftTUs7QpkyoyYLT/qqDGl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc6f530cf0e3715a60c956928d41d329daf189b3d095fbb9239d243fc6893db.dll,#1
  2⤵
  PID:1932

memory/1932-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x00000000001D0000-0x0000000000206000-memory.dmp

Filesize
216KB

Download