4767bd22b0534fdf25f7f23e5bab681c116175d5d7f4b2550e2fe901df4bba72

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:59

Target

4767bd22b0534fdf25f7f23e5bab681c116175d5d7f4b2550e2fe901df4bba72.dll
Size

302KB
MD5

2a3167b32bfe75a91fd2df248b066111
SHA1

bf6af3dccdd96cd1585b6ada4e489185acef65fd
SHA256

4767bd22b0534fdf25f7f23e5bab681c116175d5d7f4b2550e2fe901df4bba72
SHA512

c1dbde469b8a700f7cc459c53991a3e5015d0a4d6887483715f303f157b148b5da4691a37ddf715f89e539de32a5fa92c38f768b6a8f2662ac3ec806eea5dab7
SSDEEP

6144:Kj356rq4D2wogfjkzltr5+VGkDtG2bi4fhLxfzmxQB0dNd:IIpDOzbt+VvDE2bi4fhLxSd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe
PID 868 wrote to memory of 552	868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4767bd22b0534fdf25f7f23e5bab681c116175d5d7f4b2550e2fe901df4bba72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4767bd22b0534fdf25f7f23e5bab681c116175d5d7f4b2550e2fe901df4bba72.dll,#1
2⤵
PID:552

memory/552-54-0x0000000000000000-mapping.dmp

Download
memory/552-55-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/552-56-0x00000000607F0000-0x0000000060840000-memory.dmp

Filesize
320KB

Download