2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
79s
max time network
144s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

1.5MB
MD5

dbac2c9c7545463a542820337e504dd4
SHA1

f1927a37103145678bffefd2437d3c18a9b68831
SHA256

ef022b706eab8542d2cf3be7de64b66cb809509732b08f6e055abeb84bdbba48
SHA512

298dca7f6a9b9557305d435463063b421285d2420f581f28770ffb837dee55ae7ab99547bbd5e4d80da7958d1eb259f0d3c8262bbbd71517d89a0de47795d384
SSDEEP

49152:7wZEkRqxYYYGkMzgBss/g6hIOd9uZNMcC8CFyluyplN1vn:QEnxdHkMz8ss/g6hISuzvCFysyplN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 1136	1924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
  2⤵
  PID:1136

memory/1136-54-0x0000000000000000-mapping.dmp

Download
memory/1136-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download