41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24

Analysis

max time kernel
100s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 01:39

Target

DPlayer_lv/libeay32.dll
Size

995KB
MD5

ce4dd10bde6f69fd3affbab1bf799c1e
SHA1

a7c0f9eb899d606baa7e2a01e48d9c7098b27ca1
SHA256

dbb7280d2fa2924b52d3be1617f399ac5b6801ca2497aa39b46a41cc931860dd
SHA512

dedff320a26ef4ccfab89fa7619bd125c5dab39186ae167424e093ae0247394f6f1d10e89edb3acbe38b4842a9adf6182ea4b4fbf3e5c8487246883aeead3c73
SSDEEP

12288:fDOiZOS6Vbf1xnugEIgTah4cTxdHnqgsRSCs9dAqiW1/C3XfNKreypkbWOsassJa:+CdcTxdHxpThLAfNCp/sXJmVfGyZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1012 wrote to memory of 752	1012	rundll32.exe	28
PID 1012 wrote to memory of 752	1012	rundll32.exe	28
PID 1012 wrote to memory of 752	1012	rundll32.exe	28
PID 1012 wrote to memory of 752	1012	rundll32.exe	28
PID 1012 wrote to memory of 752	1012	rundll32.exe	28
PID 1012 wrote to memory of 752	1012	rundll32.exe	28
PID 1012 wrote to memory of 752	1012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\libeay32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\libeay32.dll,#1
  2⤵
  PID:752

memory/752-54-0x0000000000000000-mapping.dmp

Download
memory/752-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download