c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 18:16

Target

c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d.dll
Size

10KB
MD5

0e13dd93d6b755667409f7b18ca5e75e
SHA1

1e81356dee9f36de0d43c59be1b12b2b17bd2755
SHA256

c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d
SHA512

a3894fe0ed6e15d0af208f30516c1e0322aff7f3924803c60fa73809c9a66ea8e56b3471506f16eeff90c281258e6e016936b9c2b14766245409cdfcd6affd63
SSDEEP

192:Fw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w9wv:ndHad/N20IypWak8dWiWak8EdWN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28
PID 1784 wrote to memory of 1036	1784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d.dll,#1
  2⤵
  PID:1036

memory/1036-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1036-56-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download