36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c

Analysis

max time kernel
32s
max time network
135s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 23:16

Target

36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c.dll
Size

248KB
MD5

91dac98be6696f9ea3337277b643a098
SHA1

37d5eed096e22fc4c48628f5bbfb8463b902b8af
SHA256

36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c
SHA512

9b100bf2eb3251108f0ddcb96cff8c50bb6b1865fee60e0fc6a52dd36b88d114bc2c5f82e13b2de366ca3872b819bf99a08c4eb4844428829b05b5d57db2178b
SSDEEP

6144:ywx1W/aIumH7aTiB6mqhv5LgjaEX7Rs0:ywx1WyIpHeTiB6mqAX7h

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27
PID 1736 wrote to memory of 1744	1736	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36b398fc8629d2fc1aa8511ea9d5e3f711694d08b0b75014af95c3ab47cf8f8c.dll,#1
  2⤵
  PID:1744

memory/1744-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1744-56-0x0000000062F30000-0x0000000062F6F000-memory.dmp

Filesize
252KB

Download
memory/1744-57-0x0000000062F30000-0x0000000062F6F000-memory.dmp

Filesize
252KB

Download