801983225cf4ef8c5b89884f96a2fb6f182ad2b73268938855816a53191b92b5

Analysis

max time kernel
18s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:05

Target

801983225cf4ef8c5b89884f96a2fb6f182ad2b73268938855816a53191b92b5.dll
Size

361KB
MD5

533c2ac8248bcfe7354bb98693cd19de
SHA1

ade7def80bae2f24b65b1098c6431022e1c5904f
SHA256

801983225cf4ef8c5b89884f96a2fb6f182ad2b73268938855816a53191b92b5
SHA512

e3c7621972bff8f2cac7a8f9a6c615ec841074769006d6bc097a2982f2e1209b487f9f4288c1c1d16c8375826cdc875c6e80640d1b8d58565c0dac74bd4edc0a
SSDEEP

6144:eigEwzuBmYaCDYyQi7ieC+b1taRZLLsUacr7pZ2GWLfvqffxOHF:e/LzuBHakt7ielxtaEcr7/ezF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 956	1928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\801983225cf4ef8c5b89884f96a2fb6f182ad2b73268938855816a53191b92b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\801983225cf4ef8c5b89884f96a2fb6f182ad2b73268938855816a53191b92b5.dll,#1
2⤵
PID:956

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000073E70000-0x0000000073ECE000-memory.dmp

Filesize
376KB

Download
memory/956-57-0x0000000073E71000-0x0000000073EC6000-memory.dmp

Filesize
340KB

Download
memory/956-58-0x0000000073E70000-0x0000000073ECE000-memory.dmp

Filesize
376KB

Download