d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:29

Target

d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437.dll
Size

264KB
MD5

255b0bed78eef3da3442c08f2be57789
SHA1

125a9798d45e79657ec43307ef274abff770a079
SHA256

d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437
SHA512

5c11197e61bc088e63f483b3ccca142518d52700c4ab7041f4d6c958125fafe22f707d5b98576391b134002138d1d3c64c772c856b0174ddc1f628968eb9f544
SSDEEP

6144:BeL0KFGgYCE2L1F5A9bEGUevXvw5+zkUpfRw6XlADfUqVzGlCPKn0:BHNCE2VAmGj/zkU7dXlADfzkls40

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe
PID 1504 wrote to memory of 1628	1504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d80aef6824cc6aa935ed9c423e6761aeb299152382cb2f108481ab28e3d58437.dll,#1
2⤵
PID:1628

memory/1628-54-0x0000000000000000-mapping.dmp

Download
memory/1628-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x000000006D220000-0x000000006D262000-memory.dmp

Filesize
264KB

Download
memory/1628-57-0x000000006D220000-0x000000006D262000-memory.dmp

Filesize
264KB

Download