aa7ff7cfe4e452cb0c9ca62f36b717ca0c7dd8856f145f6732e03eea94f33df7

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 16:30

Target

aa7ff7cfe4e452cb0c9ca62f36b717ca0c7dd8856f145f6732e03eea94f33df7.dll
Size

132KB
MD5

82b1d60a46d6965f36c2637e206658c2
SHA1

836b4ecbc8169d031c948e4bd2960fe29854c5d6
SHA256

aa7ff7cfe4e452cb0c9ca62f36b717ca0c7dd8856f145f6732e03eea94f33df7
SHA512

31e9f7e14b93367849a5eb08aec84485e51e7c8b29fe5049671d1886e2582f185f1034f0860e5e3f45960c257da446a0edc049870e7f738a47e54cf6e42b1e31
SSDEEP

3072:wZNYDWk2ganZERnq/p4lmaD5XfWNXBp3rq4c9n9GE:0Y6yanZmop2+xler

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27
PID 1768 wrote to memory of 1284	1768	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa7ff7cfe4e452cb0c9ca62f36b717ca0c7dd8856f145f6732e03eea94f33df7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa7ff7cfe4e452cb0c9ca62f36b717ca0c7dd8856f145f6732e03eea94f33df7.dll,#1
  2⤵
  PID:1284

memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1284-56-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download