2feb8531b03da5046bd7bc955fe0f443d07c77289064ab148c16a35f89e921c6

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 15:43

Target

2feb8531b03da5046bd7bc955fe0f443d07c77289064ab148c16a35f89e921c6.dll
Size

540KB
MD5

8264db4ac043411ec0ff8198ce27be59
SHA1

6839110cc302763d16a45f1585fd49de8e8e6122
SHA256

2feb8531b03da5046bd7bc955fe0f443d07c77289064ab148c16a35f89e921c6
SHA512

2c1e89e2e9ba7cea6078238bcfe5598f4f94a343f1e7c116735c32cd5dae37c4cd9f5a7d6c2424507eeb8aa67560311b79591a5b592aa3b68b09438414753b8c
SSDEEP

12288:UxZkGA9m5AP4QmldXUGYv7Png4LWbG0GbYjRg2UVsAarPoK5U1Im3pHQCaOOfa:Uv5AP4QmlGgy+GbYjRxUS9LoKk9Iha

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2feb8531b03da5046bd7bc955fe0f443d07c77289064ab148c16a35f89e921c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2feb8531b03da5046bd7bc955fe0f443d07c77289064ab148c16a35f89e921c6.dll,#1
  2⤵
  PID:1972

memory/1972-54-0x0000000000000000-mapping.dmp

Download
memory/1972-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download