36aaeaacd791b40eb52c9efc7c48cf5991af2b491c53b23eee91c0c0023c7876

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:51

Target

36aaeaacd791b40eb52c9efc7c48cf5991af2b491c53b23eee91c0c0023c7876.dll
Size

28KB
MD5

0d1f68ef16a76d0263a45b427ce46130
SHA1

6f4fcaa8e0d8b3853e246dfad591a24433ad69b0
SHA256

36aaeaacd791b40eb52c9efc7c48cf5991af2b491c53b23eee91c0c0023c7876
SHA512

d40134be5578ed2da3c1de57ffd167b225d435a8c501e6ffbf54766ddaec5cb68e54a5d2b31ab2a244d5bed5c42c9ed089096c91ecda56ced338492aa1131ae3
SSDEEP

96:wI1+l2n11FhplC7N7lM1ygBqOB9ErQAQY:dIrQAQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36aaeaacd791b40eb52c9efc7c48cf5991af2b491c53b23eee91c0c0023c7876.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36aaeaacd791b40eb52c9efc7c48cf5991af2b491c53b23eee91c0c0023c7876.dll,#1
  2⤵
  PID:1736

memory/1736-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download