06ba17c5606f40b260f0c0158fa78a52224b251727ee650ae2ea611d3206cf26

Analysis

max time kernel
127s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:17

Target

f1aa3e3b09a8c84cbfaaaef076b3e19a79bb1a82ee5905a2358bc4d2167225de.dll
Size

505KB
MD5

1382e3d0199f8db6deb016a7d6e11684
SHA1

701e3acad5ca1151dda7d76893bcba5a3eedf016
SHA256

06ba17c5606f40b260f0c0158fa78a52224b251727ee650ae2ea611d3206cf26
SHA512

d727a5f49075c4f2f9f7e872ca9231e618cc5836eaf6493547e08413fbc53ca837ca3127a0932d7683425881df1a43553832f6477c3d3714a12701934c92ce91
SSDEEP

6144:RZn93qk+7206ViSn9hagxr1nIJ03ggHdhsdbRfeeOM:RBhqVi+saa6J+ggHbsdweOM

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

1 1612 rundll32.exe
2 1612 rundll32.exe
4 1612 rundll32.exe
5 1612 rundll32.exe
6 1612 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe
PID 532 wrote to memory of 1612	532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1aa3e3b09a8c84cbfaaaef076b3e19a79bb1a82ee5905a2358bc4d2167225de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1aa3e3b09a8c84cbfaaaef076b3e19a79bb1a82ee5905a2358bc4d2167225de.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1612

memory/1612-54-0x0000000000000000-mapping.dmp

Download
memory/1612-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download