67104bd6f572f0079dd14ec63d44f7b3ce78e7f1c3d6d0800107642e79e30912

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 02:44

Target

67104bd6f572f0079dd14ec63d44f7b3ce78e7f1c3d6d0800107642e79e30912.dll
Size

254KB
MD5

a2b66424ce96f2e42291f2133d440d9c
SHA1

86e6bfc7324eaffaa5eb9ce05dc21b58fac920e0
SHA256

67104bd6f572f0079dd14ec63d44f7b3ce78e7f1c3d6d0800107642e79e30912
SHA512

81719b8f55b8c77883d5c3a5efda0997b30cbcd703a853a953c8ad84a7f07c8b0ee10ec98a58a48116b7194ec53a146e4b8e8d9f04b1b573672306be7968dc1b
SSDEEP

6144:HKJ3t+g0QPekyswLCwuSr08hKZFXZoMq3gv:HY3h0igTx9nXMOc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27
PID 1792 wrote to memory of 1164	1792	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67104bd6f572f0079dd14ec63d44f7b3ce78e7f1c3d6d0800107642e79e30912.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67104bd6f572f0079dd14ec63d44f7b3ce78e7f1c3d6d0800107642e79e30912.dll,#1
  2⤵
  PID:1164

memory/1164-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1164-56-0x0000000010000000-0x0000000010045000-memory.dmp

Filesize
276KB

Download