4b29c3a3709fe6d90029f2767a3ccf6148d4e574a4daf4f2e952f3a21aa28a2a

Analysis

max time kernel
53s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:57

Target

4b29c3a3709fe6d90029f2767a3ccf6148d4e574a4daf4f2e952f3a21aa28a2a.dll
Size

276KB
MD5

444d1e94a1455d4602d98d0a0dbfb020
SHA1

9fbdab2ec811a904c597854f39636091b0bfd991
SHA256

4b29c3a3709fe6d90029f2767a3ccf6148d4e574a4daf4f2e952f3a21aa28a2a
SHA512

20b499a8cfd247889b38ea171175f8a424c3e2fabf73abd0712eda514c0cd81fee1d287d8420713550e3fa1c4a45106f67960940efd9f0ba837e4138dde386ad
SSDEEP

6144:tFLNrMN3Vb+lzR3x1EYjqwPan20bF890hlocd6:/1axezR33+3bFjhj6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2004	1044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b29c3a3709fe6d90029f2767a3ccf6148d4e574a4daf4f2e952f3a21aa28a2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b29c3a3709fe6d90029f2767a3ccf6148d4e574a4daf4f2e952f3a21aa28a2a.dll,#1
2⤵
PID:2004

memory/2004-54-0x0000000000000000-mapping.dmp

Download
memory/2004-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2004-57-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2004-58-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2004-59-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download