99af68adf9874f5bf5efae9de6b001a934441be1d2acf554aa2e5390d2e91807

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:02

Target

99af68adf9874f5bf5efae9de6b001a934441be1d2acf554aa2e5390d2e91807.dll
Size

331KB
MD5

0069c527133dffc3f0ecf0796ec93845
SHA1

6599eaa2e7edb0a52c5168610f4c0e0b4c571f78
SHA256

99af68adf9874f5bf5efae9de6b001a934441be1d2acf554aa2e5390d2e91807
SHA512

b5fdf4e997e764d3226d76b5fc8e6e965af80e8a2826ef16c93117beb1eca91db32ace26bc7f54586e5c70c3bd44363493a78b39b4cc33be0b1a22f00b35368c
SSDEEP

6144:Ru/nbMxQylt87Cqi/zznv4sGA8sxWae6u2Bya/rtU61I+AK3uK6HxjnLJtQodWiK:E/bMhtBqWLus4ae6lyap1I+Ayu7Hxjna

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2004	1280	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99af68adf9874f5bf5efae9de6b001a934441be1d2acf554aa2e5390d2e91807.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99af68adf9874f5bf5efae9de6b001a934441be1d2acf554aa2e5390d2e91807.dll,#1
2⤵
PID:2004

memory/2004-54-0x0000000000000000-mapping.dmp

Download
memory/2004-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2004-57-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download