771bafe44b3b2a488351b345a35b651bb1fd7c1e3ec909f7b77dcb109e5b096e

Analysis

max time kernel
78s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 06:08

Target

771bafe44b3b2a488351b345a35b651bb1fd7c1e3ec909f7b77dcb109e5b096e.dll
Size

82KB
MD5

49233c16a3fae31fab7fba6d228943b3
SHA1

b4f974b9bed68e4ac5cf2fa82098132c8a4b3a74
SHA256

771bafe44b3b2a488351b345a35b651bb1fd7c1e3ec909f7b77dcb109e5b096e
SHA512

710c241077f024a8d6af0206a3f7c5f259f69eb1e9b9d59dd31c2c7f9b0522e29f13a7ff70dfbb167931049c5b2d0c8b87b976bc1716adb451cda21a01a7920c
SSDEEP

1536:ptLVqfSckxFSVVPuYJwvpz8kYPFw1rNSjp35724NoVVWZ5DnCCxcYW4n0z/mk5kM:ptggjSbPuYqpzdYNwFNSjp31NXDni+X+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28
PID 1428 wrote to memory of 1616	1428	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\771bafe44b3b2a488351b345a35b651bb1fd7c1e3ec909f7b77dcb109e5b096e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\771bafe44b3b2a488351b345a35b651bb1fd7c1e3ec909f7b77dcb109e5b096e.dll,#1
  2⤵
  PID:1616

memory/1616-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1616-56-0x0000000001D10000-0x0000000001DF7000-memory.dmp

Filesize
924KB

Download