c5e9e78bd80d54251aae2789dfca99c4ca91d2a0161c22374453eb3a2e09d7db

Analysis

max time kernel
41s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 03:46

Target

MDPFintimaoID3290X6MKR00&BR#.dll
Size

440KB
MD5

1a259187ace8ce94d2acf9724e04844d
SHA1

a51671c03a4273dbef0625a55b579a20648f0c9a
SHA256

d7b62d8a7830a383708a73712412999ee100af82998a1b76ab85b3608c57f959
SHA512

dfd1244cc44aede5cee83efbf7ead7e5c2fef6e94a5d94857f7c3ac13bec58e954f4bd0775e85584ad11b61fa4752b49869455037a43cb13714382a682d3a114
SSDEEP

6144:NND9bVWslhKuNf7G+zjaEtggt71YmehhTFA2Cs9KP6/Y1UzqYvW3CedseVwuWpDp:tbVWehVNi2J1behTAEKeYazqYMqD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2028	1224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MDPFintimaoID3290X6MKR00&BR#.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MDPFintimaoID3290X6MKR00&BR#.dll,#1
2⤵
PID:2028

memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x0000000000700000-0x0000000000773000-memory.dmp

Filesize
460KB

Download