2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:53

Target

2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd.dll
Size

59KB
MD5

0f5583d8d8bfc6d17b404c414349f48b
SHA1

0a78d53939a0a55b226f708fb871e9af1684e73b
SHA256

2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd
SHA512

e1d1738cca63844ddb94b8614bfdc98435c8da9c088265f79d387db1bd936f92d83f66397dff77b81e2346bdcfe675da2fc5db973cc857ffae117abf1b0a4626
SSDEEP

1536:Cgm4z/jyqizD1lMmB6V59GhFAMmEobxVn:C7ueq8N64Yoobx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27
PID 536 wrote to memory of 1524	536	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cdd2c8e50e757b50619dcd10ebb23d9aa3c0b7e2eb9319ef60f563143e307dd.dll,#1
  2⤵
  PID:1524

memory/1524-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1524-56-0x00000000000B0000-0x00000000000BA000-memory.dmp

Filesize
40KB

Download
memory/1524-60-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download