aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:42

Target

aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69.dll
Size

390KB
MD5

2ab40a118415a853056d81aef4df53ed
SHA1

48483a0c3c21eab5d86f51ab046b8a7c39531e0e
SHA256

aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69
SHA512

3590514b98642fbec884b42343e1f0f3b05c1f83a0025df4b9600c774733d236a1cd15dfdaaf5466273d1f5a8f8fb02bfcc7c3149d0da86b90c2f3050489959c
SSDEEP

12288:foEOND+F3Z4mxxKirMmh1NwpBU6YmANogZx:foLNqQmXKAh1NwpBUaKx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 980	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa33b4ae7da34be1686a78b9144b824dc5bfa201b9ca6f83ae7ed240c08a5b69.dll,#1
2⤵
PID:980

memory/980-54-0x0000000000000000-mapping.dmp

Download
memory/980-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download