dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e

Analysis

max time kernel
46s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 12:18

Target

dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e.dll
Size

69KB
MD5

0745c9f1b27287a5773b87d045450b83
SHA1

49e33e4cb984f239725d693981b7d5ac64e1468d
SHA256

dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e
SHA512

af62766934f456734d94862d0e2e7c0c8aa14818a36605864573d0f0c44b069dee2a80539c6f5cfa0637dd195f27967de589a8b1c5cd958637cdaf8b188e39ae
SSDEEP

1536:1LLKh7Wt5esFOu0+EBT0lk77y7caeyZN7:xLJdOu0+flknDaBZ9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 900	1128	rundll32.exe	24
PID 1128 wrote to memory of 900	1128	rundll32.exe	24
PID 1128 wrote to memory of 900	1128	rundll32.exe	24
PID 1128 wrote to memory of 900	1128	rundll32.exe	24
PID 1128 wrote to memory of 900	1128	rundll32.exe	24
PID 1128 wrote to memory of 900	1128	rundll32.exe	24
PID 1128 wrote to memory of 900	1128	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc9bd01d841d95c37ed2cb766aa8644ed11906e294ad85f56037de37862ead2e.dll,#1
  2⤵
  PID:900

memory/900-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/900-57-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download