445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968

Analysis

max time kernel
67s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:49

Target

445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968.dll
Size

360KB
MD5

26381d1cef6045508b51121e04636fa9
SHA1

6015b7d744b9a421221bd5589fba8a71e36e5555
SHA256

445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968
SHA512

9866b90b056dff6ca1dad6314464b44dad4c4746e66dc5789c7d1e086a71152551d50a546056bb0fcba0c0aedbd6b3ae988e027ca4c55e138497a81928263ad3
SSDEEP

6144:awM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:tkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe
PID 892 wrote to memory of 432	892	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\445cb39640fe84aefc94af047c67353fbdc6fed8a804cc541589b35779316968.dll,#1
  2⤵
  PID:432

memory/432-54-0x0000000000000000-mapping.dmp

Download
memory/432-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/432-56-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/432-57-0x0000000073E71000-0x0000000073EC6000-memory.dmp

Filesize
340KB

Download
memory/432-58-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download