a7367a503f981d69e003268c6f038965835370df879459a6d85f02823b934d35

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:10

Target

a7367a503f981d69e003268c6f038965835370df879459a6d85f02823b934d35.dll
Size

76KB
MD5

a3b54be297dee5e88c9418d1728844ad
SHA1

f19d6fa94d95a8bbd5d79603c1cdac443913046d
SHA256

a7367a503f981d69e003268c6f038965835370df879459a6d85f02823b934d35
SHA512

27793883378b209baa3f08ea2ebf75e5ff5a975f2e561fbff542d6a301996cc749b7875030af418772c003c2a373b2702e3869ac36308c6ea62218fe4e2694b9
SSDEEP

1536:7WLHbYFNSPl+eDDCWJOS9u405Rm6nToIf6IOsIOIWobfs:7W3YFQUeDDCWID405RmWTBfIiIWobf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe
PID 1668 wrote to memory of 1520	1668	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7367a503f981d69e003268c6f038965835370df879459a6d85f02823b934d35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7367a503f981d69e003268c6f038965835370df879459a6d85f02823b934d35.dll,#1
2⤵
PID:1520

memory/1520-54-0x0000000000000000-mapping.dmp

Download
memory/1520-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download