db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542

Analysis

max time kernel
33s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:49

Target

db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542.dll
Size

31KB
MD5

32e98b5fc1457f979165ea379f1f3100
SHA1

d06b7547a9a02616caa40c86351eedf85bf71c29
SHA256

db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542
SHA512

63eac034834d65fec45e63b60a5a0abdfbc558afa601fdcd020f9d1718f8ce29c39d89aa7c6960b923180be26f45faeabec83621703016d7cbab4cbda59f2c26
SSDEEP

192:VRRQmkmHk+NIlKa1O0xMtMNwbHEcvTGwdRODWZqL2Z:VRPkGkDKWO0YJjEAGmOWEc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28
PID 2016 wrote to memory of 1976	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db9e20a72d67e545434b968df180db21a653819d1063c314b969d6405763c542.dll,#1
  2⤵
  PID:1976

memory/1976-55-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download