b961675ee03d01e73d407dff539d68aa87cbe16bcde4c88acc628de662c3efa3

Analysis

max time kernel
14s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:11

Target

b961675ee03d01e73d407dff539d68aa87cbe16bcde4c88acc628de662c3efa3.dll
Size

348KB
MD5

43eb0861ad7bcc0c80786d1562ab1009
SHA1

a225f3865893596e5c982a312aae4c251f626540
SHA256

b961675ee03d01e73d407dff539d68aa87cbe16bcde4c88acc628de662c3efa3
SHA512

83592aa097a8a7005077966fd7278297e8c839a7af78199ebf189be59a69d22ccac06289967b923dfc0b077cceddb6eb378903a785c25e7e205d68fe2650db5d
SSDEEP

6144:3Z2WedUQ+3juk2rQyBI/Msz1UolMyfhtVV3eHLj5nUhFc9GMYB8D:0ndc0QwcMszFlMyfnuHPpUXc95YB8D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe
PID 1444 wrote to memory of 1344	1444	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b961675ee03d01e73d407dff539d68aa87cbe16bcde4c88acc628de662c3efa3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b961675ee03d01e73d407dff539d68aa87cbe16bcde4c88acc628de662c3efa3.dll,#1
2⤵
PID:1344

memory/1344-54-0x0000000000000000-mapping.dmp

Download
memory/1344-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/1344-57-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download