9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:45

Target

9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll
Size

10KB
MD5

61264f4f54dd61fac30f152c096b0a28
SHA1

6c1219fe4bc16a22e69995f08eaab4b1461ae925
SHA256

9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4
SHA512

9b08e5a0e2b41f85a8bb99e10be154f72b31f0f070c5b0e149caaaa8ec5c78633237652ff93e0dc961934d4c68e02768fc56324e9e89b763f74dc46a37364b0e
SSDEEP

192:ljMnPLqkkQq3hab0LBdFpjg04hoDajg6luF5khNGafB:6qkvqRYW9pjmhoehNGo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1508	1088	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll,#1
2⤵
PID:1508

memory/1508-54-0x0000000000000000-mapping.dmp

Download
memory/1508-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1508-56-0x00000000745B0000-0x00000000745BB000-memory.dmp

Filesize
44KB

Download
memory/1508-57-0x00000000745B0000-0x00000000745BB000-memory.dmp

Filesize
44KB

Download