dbdb12c67c0e4aac2b19ffd82c4478216e52c784f6d8674bce1579520ae14034

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 07:13

Target

dbdb12c67c0e4aac2b19ffd82c4478216e52c784f6d8674bce1579520ae14034.dll
Size

60KB
MD5

30b7087830f12c2831b685e3e4d6923d
SHA1

c08f6cb667816a46ba984671115eb9f28488af22
SHA256

dbdb12c67c0e4aac2b19ffd82c4478216e52c784f6d8674bce1579520ae14034
SHA512

6276b2c0c2fd157415ff64670f8f22a4c4da9b1ee711bbdc40dfb669a07fcaa0dd57bd6df06f6de4fab8e51384c1121b2c40916115f52cbf3208171e0f3762ee
SSDEEP

1536:MhBRVgrExucMknuxI6oJAUla+/EefhuSdC4g/QIwt:cRRsk+rgvdC4+J8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27
PID 1652 wrote to memory of 1072	1652	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbdb12c67c0e4aac2b19ffd82c4478216e52c784f6d8674bce1579520ae14034.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbdb12c67c0e4aac2b19ffd82c4478216e52c784f6d8674bce1579520ae14034.dll,#1
  2⤵
  PID:1072

memory/1072-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download