60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 20:21

Target

60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577.dll
Size

172KB
MD5

0eff937777f5a44e2a88c442d9b4f0a3
SHA1

8cdea53a53bc88632c14cb6b34e704c714901704
SHA256

60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577
SHA512

3c5d2d683887822034adeae8e58d65b442add32d9f764047258533314676f31979955675d1bf78c4d16026d0c49669fe448e92ede32a3fb77b5dfb4c8b466952
SSDEEP

3072:zG/3vn1wVgA3GMBwHOg5PPjzz6LWij2jbZC8pHAhtJctgi:C/3t0GrHOg5jzMWHU8pgKtg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28
PID 1972 wrote to memory of 1032	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60daa3f340d28ea20677a09274cdb6b2ca35dd4138cba579b716376ea4f86577.dll,#1
  2⤵
  PID:1032

memory/1032-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download