609b3c3a5524cd2c356f2725b54657570f7c0a034c01bda279c2488e170a92e2

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:51

Target

609b3c3a5524cd2c356f2725b54657570f7c0a034c01bda279c2488e170a92e2.dll
Size

76KB
MD5

0c7f72b1c45670cfbc04851104c24340
SHA1

3cc2ceb94aa6e3239792f329a94ae18726fa078c
SHA256

609b3c3a5524cd2c356f2725b54657570f7c0a034c01bda279c2488e170a92e2
SHA512

da8856228bb0460c56f3335877848f355963327a739f5c9f6ab7d1f60a5f9e16a64527efc99fdeb59196cee5d1724f7caa9378965fb1d6f03d167f1b7a4f92a6
SSDEEP

1536:9DWFwc8+TpKSKiuowMAYGpAYJnodSIINxHvTrUKOXh4j:9Dowc8FiuCAYGpAYJnodQvE4j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28
PID 2012 wrote to memory of 1932	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\609b3c3a5524cd2c356f2725b54657570f7c0a034c01bda279c2488e170a92e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\609b3c3a5524cd2c356f2725b54657570f7c0a034c01bda279c2488e170a92e2.dll,#1
  2⤵
  PID:1932

memory/1932-54-0x0000000000000000-mapping.dmp

Download
memory/1932-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download