1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d

Analysis

max time kernel
102s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:55 UTC

Target

Ծע/krnln.dll
Size

1.0MB
MD5

44e2ca67c060fbe3dc0d030149f5a478
SHA1

5df61eb626bc3849893701942114609c1086d496
SHA256

6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93
SHA512

1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e
SSDEEP

12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28
PID 1628 wrote to memory of 1720	1628	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\krnln.dll,#1
  2⤵
  PID:1720

memory/1720-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download