396a881c2000ebfa506082b0996aa50a89c93716cdbf0191e641e9e0c7143fcd

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 00:59

Target

396a881c2000ebfa506082b0996aa50a89c93716cdbf0191e641e9e0c7143fcd.dll
Size

67KB
MD5

1d69cb31747a6c40c7104c5ee50b015e
SHA1

685b50cd2c894cd6a4511249b2ce24b20b38f787
SHA256

396a881c2000ebfa506082b0996aa50a89c93716cdbf0191e641e9e0c7143fcd
SHA512

53505737c443959c663f3531bff4ff3c7558db033f1359f56278246603b3e7d97974abeceddaab0ecd49006a9d2e429658fb8f1d57970203b40b8e478dc885ad
SSDEEP

1536:7nrxDussGn4AAejPC7Mp/c+HJgKKWz3p/wBBwC:D6tV0pk+pg6t/EKC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\396a881c2000ebfa506082b0996aa50a89c93716cdbf0191e641e9e0c7143fcd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\396a881c2000ebfa506082b0996aa50a89c93716cdbf0191e641e9e0c7143fcd.dll,#1
  2⤵
  PID:816

memory/816-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download