076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c

Analysis

max time kernel
2s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:48

Target

076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c.dll
Size

12KB
MD5

55ddbed230f4ed9edc570c7330bcec00
SHA1

44eb85027847f0beabdf43ec1c57df422568a489
SHA256

076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c
SHA512

0dc5c87c55ebf1d3fc0a67e803ad385c7968cda740a4082c086faa9161f866cfa33ad34e1ab7d3e7af3bdd6aea7282e76854eb855310bd6e62942f5f580df0f3
SSDEEP

384:gRwXtXjLXEIzZbrn/7m9KcT00XJPAHKWH8B7WI:J9XjLXEwbriA7oB/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 960	1956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076caa3f9400f8ef68fc52c9ab30583ab93e1040267252d5a2f4f2f70a391a3c.dll,#1
2⤵
PID:960

memory/960-54-0x0000000000000000-mapping.dmp

Download
memory/960-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download