6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:05

Target

6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e.dll
Size

332KB
MD5

3e44f9d9f61d0c0e79558aeaebda1ed5
SHA1

8076dc7ea459880393d25b980796e03c7453c508
SHA256

6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e
SHA512

f11864aa0923158000b375692ff5ce3698aa7f3e169892433570a46675dfe4f7e70d8d07bbc9c2283c60e5a842c440e6ebf10d8ad9da381d682319a1afd60141
SSDEEP

6144:jM84jI4d4eDp0dWk4nDWgRAkP+5S2GQn8xID0DMFxtTEgxK3r7IKNb3yMo:Y/k4d4eomR3P+s2GLxe0DStIgx4rEKNM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1948	1444	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e.dll,#1
2⤵
PID:1948

memory/1948-54-0x0000000000000000-mapping.dmp

Download
memory/1948-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x0000000000710000-0x0000000000778000-memory.dmp

Filesize
416KB

Download
memory/1948-57-0x00000000002A0000-0x00000000002E0000-memory.dmp

Filesize
256KB

Download
memory/1948-58-0x0000000000900000-0x0000000000A10000-memory.dmp

Filesize
1.1MB

Download
memory/1948-60-0x0000000000A10000-0x0000000000AB0000-memory.dmp

Filesize
640KB

Download
memory/1948-59-0x0000000000B00000-0x0000000000C00000-memory.dmp

Filesize
1024KB

Download
memory/1948-61-0x0000000000800000-0x000000000088F000-memory.dmp

Filesize
572KB

Download