92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:24

Target

92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6.dll
Size

5KB
MD5

2f9bced7b019cd0bfcb9a9fa62f788d0
SHA1

31720571b5a2cd202d9a55fda486561b1aa692fb
SHA256

92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6
SHA512

528494865c71fd65315e8e5002ec20804a625856f992d2d90aaa06e6f9ff92af9cd3d68ced5622d67a1938801f7cd9f1c687bfdf68304a4921d18c3e5211c6e7
SSDEEP

96:nEY2RrF1eqwi4rcccqccccqccccctcccqqqcqccq8cqc8qqcqccccqPqcc8qccX+:EHRh1eppX0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92dde1e37f8136c7216372e7a02a224d3f46075c3e93f12e818de248a0c020a6.dll,#1
  2⤵
  PID:1976

memory/1976-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download