84b2dbd98727e150310170a7e0d0c5db2697a7420e3d57f70d851b7c56fb6cb0

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:37

Target

84b2dbd98727e150310170a7e0d0c5db2697a7420e3d57f70d851b7c56fb6cb0.dll
Size

22KB
MD5

74137a263aa576a3f604332bf9980beb
SHA1

7fff35e7dd2ec7f3e9fa1efda186614e234a30d8
SHA256

84b2dbd98727e150310170a7e0d0c5db2697a7420e3d57f70d851b7c56fb6cb0
SHA512

16c0a658b503c1da3f1b853f734ac4c336c7a4050bd9aabe45a649def5435567c4dd5debe8d2aa12b0a7a671a34ef38b8601cc5f508e8a2e19fb273f1950d8ec
SSDEEP

384:TeH+tWzlSDrb5+gIS3a2Oaa2pbNGJ38pPJv1TCAxAr6+S9Pfu7n5p:dtWurb6SOaVwYxv1TlxndeVp

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1612	1728	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1272	1612	rundll32.exe	Wscript.exe
PID 1612 wrote to memory of 1272	1612	rundll32.exe	Wscript.exe
PID 1612 wrote to memory of 1272	1612	rundll32.exe	Wscript.exe
PID 1612 wrote to memory of 1272	1612	rundll32.exe	Wscript.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84b2dbd98727e150310170a7e0d0c5db2697a7420e3d57f70d851b7c56fb6cb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84b2dbd98727e150310170a7e0d0c5db2697a7420e3d57f70d851b7c56fb6cb0.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\Wscript.exe
Wscript.exe c:\windows\ime\vbs\pp.vbs
3⤵
PID:1272

memory/1272-57-0x0000000000000000-mapping.dmp

Download
memory/1612-54-0x0000000000000000-mapping.dmp

Download
memory/1612-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download