4fb3f7ed326ff77640d76d57dcaa796083bc13731194f08ca74dc9feb2b6609b

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 11:49

Target

4fb3f7ed326ff77640d76d57dcaa796083bc13731194f08ca74dc9feb2b6609b.dll
Size

508KB
MD5

bb8977f0de38a408883b732b209b8572
SHA1

b5ff5cb5f60b599f64605c232ad8082be7062c53
SHA256

4fb3f7ed326ff77640d76d57dcaa796083bc13731194f08ca74dc9feb2b6609b
SHA512

47975b9b15af2a14a636f024ee338a0bb91348aa12885ce6cf81f9871f7a431b8a0ea8df31fb4431835031d686d046a96c1193c8ef94a2a3cc5f89028ebde35f
SSDEEP

12288:JOZTQWKlWs4E5jy0+F3Z4mxx4Wp4qyKnNPbho:E5cl346G0+QmX7uGn4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28
PID 1948 wrote to memory of 1116	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fb3f7ed326ff77640d76d57dcaa796083bc13731194f08ca74dc9feb2b6609b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4fb3f7ed326ff77640d76d57dcaa796083bc13731194f08ca74dc9feb2b6609b.dll,#1
  2⤵
  PID:1116

memory/1116-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1116-56-0x0000000000980000-0x0000000000A3F000-memory.dmp

Filesize
764KB

Download