e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0

Analysis

max time kernel
188s
max time network
217s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 06:17

Target

e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0.dll
Size

169KB
MD5

8259695f2aa973a6545df3785aca9ca1
SHA1

c05aab287649c26812ac0abf1fa1129256909433
SHA256

e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0
SHA512

436da43fe8f2c977dab7a22417c4bd2392cbea457fbd5826854c22503c0f6498cf71bf1c43cc1ae0b7f5ec4e37a07c37a5a612acc56f31bcebf82fd3bb113df8
SSDEEP

3072:NdBvRfKMft58yBvlx35CgF4qSJ3hU3e5:NdBvvBvb35ZF3SJ3

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1216	1364	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 1080	1216	rundll32.exe	notepad.exe
PID 1216 wrote to memory of 1080	1216	rundll32.exe	notepad.exe
PID 1216 wrote to memory of 1080	1216	rundll32.exe	notepad.exe
PID 1216 wrote to memory of 1080	1216	rundll32.exe	notepad.exe
PID 1216 wrote to memory of 1080	1216	rundll32.exe	notepad.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1191ddd30928befeb253af4ff74c8d78a985f9909bdf80d8bb27a38160f73d0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\System32\notepad.exe
    3⤵
    PID:1080

memory/1080-57-0x00000000000D0000-0x00000000000EB000-memory.dmp

Filesize
108KB

Download
memory/1080-56-0x0000000000000000-mapping.dmp

Download
memory/1080-61-0x0000000000960000-0x0000000000983000-memory.dmp

Filesize
140KB

Download
memory/1080-60-0x00000000000D0000-0x00000000000EB000-memory.dmp

Filesize
108KB

Download
memory/1216-54-0x0000000000000000-mapping.dmp

Download
memory/1216-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download