39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab

Analysis

max time kernel
9s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:35

Target

39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab.dll
Size

34KB
MD5

66adf0091a26b2bcb3404f60437d2ae1
SHA1

c6cf88593d0769d9eb7675567bb1325823c78bff
SHA256

39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab
SHA512

e83dfb15445930d8bc7f6865e7942e26817a8b4dfd5768d7ea3404dff307aae19f8d8688633c3542a93b52999ac1bfb90e8a06ae758bbdeda6ffbac93b6b49a2
SSDEEP

768:kQ3Q80nm82+0pXYnAtZTtX4MBDJGxIduBBQARQki9hZhHADG:J3186jGxIduBBQAR+1cG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28
PID 1324 wrote to memory of 1756	1324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\39d5a67611957769bfd1f0f1dcfedb1d8aaaa40f2e655612fcf84cf018e824ab.dll,#1
  2⤵
  PID:1756

memory/1756-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download