dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba

Analysis

max time kernel
73s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:35

Target

1b1d6a59902a2dc71fb73a1b0525a668.dll
Size

1.7MB
MD5

1b1d6a59902a2dc71fb73a1b0525a668
SHA1

220db515b7ef708a7bc77f9f0636b1627a81065a
SHA256

dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba
SHA512

492526cb28ae18fe1d1e1c2aafc75501da6c1f066ee6e4605c41ca04db562f08a5eebced60c8e07fd717c902eca2cdcb0fed0158a98ca6c619947e9a1ede0ecb
SSDEEP

24576:Y4Df5rev4L3w8O05BNZJO5rFyy6+xZ9DMJq8gF2PcCx98Gcw3cwR:YiqgL3bO09OpN6+xwJqPyvz3zR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe
PID 1108 wrote to memory of 1712	1108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b1d6a59902a2dc71fb73a1b0525a668.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b1d6a59902a2dc71fb73a1b0525a668.dll,#1
2⤵
PID:1712

memory/1712-54-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1712-56-0x0000000001E70000-0x000000000201D000-memory.dmp

Filesize
1.7MB

Download
memory/1712-57-0x0000000002330000-0x000000000246B000-memory.dmp

Filesize
1.2MB

Download
memory/1712-58-0x0000000002590000-0x00000000026A5000-memory.dmp

Filesize
1.1MB

Download
memory/1712-59-0x00000000003B0000-0x0000000000477000-memory.dmp

Filesize
796KB

Download
memory/1712-60-0x0000000001CD0000-0x0000000001D84000-memory.dmp

Filesize
720KB

Download
memory/1712-61-0x0000000001CD0000-0x0000000001D84000-memory.dmp

Filesize
720KB

Download
memory/1712-63-0x0000000002590000-0x00000000026A5000-memory.dmp

Filesize
1.1MB

Download