83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 13:36

Target

83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89.dll
Size

72KB
MD5

0a783c911f443279af9fad52f4cc72f3
SHA1

45b9580eb27ccb5fbdbad4f824ed982265dd0df1
SHA256

83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89
SHA512

042fb7cb5a3128ee8150d27cc8e013480f387451919b759a03d5040d626b2eb9613789646fcbb01b9328da41ab10fe0219030490b26ceeb6c98d66d8d558cc45
SSDEEP

1536:MD7jQuJl5hfTVpP21XMVWCUUGBfX0b7540kkRZB+41zsPxMMkYaL:iRpPeXaWuu52lShaL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83da63801acab0bb4df44d80ce20f6bc94026c3b41bbd9f7c963efea34cbbb89.dll,#1
  2⤵
  PID:1528

memory/1528-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download
memory/1528-57-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download
memory/1528-58-0x0000000010000000-0x0000000010682000-memory.dmp

Filesize
6.5MB

Download