764471e6c74e5f42a87789790a022d466a64f5205e61622d45f1460f780e3688

Analysis

max time kernel
13s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:31

Target

764471e6c74e5f42a87789790a022d466a64f5205e61622d45f1460f780e3688.dll
Size

144KB
MD5

44382cbaf98d27da5274c7ca743d33d4
SHA1

9c53cb68d1f19ccb75de2146b66ac6fb2ffd71a5
SHA256

764471e6c74e5f42a87789790a022d466a64f5205e61622d45f1460f780e3688
SHA512

e9ee9ee24be4868eb54f52cc859890c3d9ea6f33acfd4ec7fb278cfa721a8f68b0843a4b249397c47407148c7f95d5b65b60de6293eb6209078f1bedbc42309f
SSDEEP

3072:Y1lVtfBilaALZroDaIMNPs7UNyp4DUzgtbA9T4g80GIMQVo72:6BilZuhMRaU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe
PID 1540 wrote to memory of 1232	1540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\764471e6c74e5f42a87789790a022d466a64f5205e61622d45f1460f780e3688.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\764471e6c74e5f42a87789790a022d466a64f5205e61622d45f1460f780e3688.dll,#1
2⤵
PID:1232

memory/1232-54-0x0000000000000000-mapping.dmp

Download
memory/1232-55-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1232-56-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/1232-57-0x0000000000180000-0x000000000018F000-memory.dmp

Filesize
60KB

Download
memory/1232-58-0x0000000000190000-0x000000000019F000-memory.dmp

Filesize
60KB

Download