83a27ef5b8edf9c744b78bab7eab6ed40eea64741fbcf59131e409fc52c0344e

Analysis

max time kernel
153s
max time network
174s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:57

Target

5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7.dll
Size

489KB
MD5

6e60c8daa198a7b8b141d574189bdea5
SHA1

a35646c19505e7215bcd9337e120b8594c80ae56
SHA256

83a27ef5b8edf9c744b78bab7eab6ed40eea64741fbcf59131e409fc52c0344e
SHA512

5bdd4730dba1f3600b19ecc4d1f8aff098ae2ab10f460d842128390b1021fe9629a903262093b30623a046145e9bb2eaf0f43d5a95f8718adf07dceb0d22ea0f
SSDEEP

6144:Yq8bD/aNTZP26JnCJVYa9aqtlUSigxtgrabTUsajM:l4ap19Ta9tUhst/0pjM

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

2 772 rundll32.exe
3 772 rundll32.exe
4 772 rundll32.exe
5 772 rundll32.exe
6 772 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 772	1944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ca7ccd312871a20cc5a35e3b115266fe8a9ceb3470844597d73a0ed8013c2b7.dll,#1
2⤵
- Blocklisted process makes network request
PID:772

memory/772-54-0x0000000000000000-mapping.dmp

Download
memory/772-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/772-56-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download