0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556

Analysis

max time kernel
50s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 05:12

Target

0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556.dll
Size

5KB
MD5

965a3250aba1e810f374a62572958bd0
SHA1

c522c46a25a618946a8cd8a3a20642893847492c
SHA256

0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556
SHA512

be20c0000ee79ab0bcc3107d979f5aaaa0cc7e2ba167f0f4fb2bb4ffefeec29c1f11ae0844b622207a881d53bd3231d952acf2ece2213edd812bfb319e64bec8
SSDEEP

96:XprYDpKnI6wJ+Ls7guyHejyn/I9l0iaiPtnMF:XUcA+ggd+W/If0i9tnM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 996	1140	rundll32.exe	27
PID 1140 wrote to memory of 996	1140	rundll32.exe	27
PID 1140 wrote to memory of 996	1140	rundll32.exe	27
PID 1140 wrote to memory of 996	1140	rundll32.exe	27
PID 1140 wrote to memory of 996	1140	rundll32.exe	27
PID 1140 wrote to memory of 996	1140	rundll32.exe	27
PID 1140 wrote to memory of 996	1140	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dd93f9f277b14a36c766e820ed1e9632ad01661b8391aa9c4a977d7d5981556.dll,#1
  2⤵
  PID:996

memory/996-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download