d88892e0760b5dfedc755ad240caf52e4e1072c4dd5fed9926c8638aedd1e6ee

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 05:12

Target

d88892e0760b5dfedc755ad240caf52e4e1072c4dd5fed9926c8638aedd1e6ee.dll
Size

265KB
MD5

0670a7c18b793662c9b8eece9bd24079
SHA1

2009ef28ac300e35edfd05446a2cdff5eb7173e1
SHA256

d88892e0760b5dfedc755ad240caf52e4e1072c4dd5fed9926c8638aedd1e6ee
SHA512

99a9acc47c5a6804309f3915a6c7082feef5b500052b5b91d52207cde2b17c16f7d967b0459ba9410323502fcd18c8b8c4fb4a33476f10a6b8c2d54182b83d4c
SSDEEP

3072:0XWocFC1dE4QrTA7OWSgiUCUf9MWVy2dxMvFO4PXlohs:0XWozdJNV5MNHP1oh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27
PID 1140 wrote to memory of 1016	1140	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d88892e0760b5dfedc755ad240caf52e4e1072c4dd5fed9926c8638aedd1e6ee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d88892e0760b5dfedc755ad240caf52e4e1072c4dd5fed9926c8638aedd1e6ee.dll,#1
  2⤵
  PID:1016

memory/1016-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1016-56-0x0000000010000000-0x0000000010045000-memory.dmp

Filesize
276KB

Download