992dd7823190e4fe01ec52fb49b739c9c8ae1c4dc859df23df0f656b26636775

Analysis

max time kernel
17s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:47

Target

992dd7823190e4fe01ec52fb49b739c9c8ae1c4dc859df23df0f656b26636775.dll
Size

224KB
MD5

32d19fea80a51c55fb3fad18151b6aed
SHA1

439908ec23c51f6f4469e089ed1955a3ddf026d5
SHA256

992dd7823190e4fe01ec52fb49b739c9c8ae1c4dc859df23df0f656b26636775
SHA512

efa7f587a63f4b1d0277eea7cb7e2047d2f232569ac53ef1ed233ab26711e0446b6f8d57713fdd85865edc921e01c9d46bb6d30722e0f31510c7fefc87a050ba
SSDEEP

3072:1Z8OtZ1hmt+ZI5rsJdhY3XPGhwK1u+Ga09FSG01IMlnqF7abrRAMFbwLfje:1yCZI5CY3U110fSGG49irh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 604	1652	rundll32.exe	28
PID 1652 wrote to memory of 604	1652	rundll32.exe	28
PID 1652 wrote to memory of 604	1652	rundll32.exe	28
PID 1652 wrote to memory of 604	1652	rundll32.exe	28
PID 1652 wrote to memory of 604	1652	rundll32.exe	28
PID 1652 wrote to memory of 604	1652	rundll32.exe	28
PID 1652 wrote to memory of 604	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\992dd7823190e4fe01ec52fb49b739c9c8ae1c4dc859df23df0f656b26636775.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\992dd7823190e4fe01ec52fb49b739c9c8ae1c4dc859df23df0f656b26636775.dll,#1
  2⤵
  PID:604

memory/604-55-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/604-56-0x0000000062850000-0x0000000062888000-memory.dmp

Filesize
224KB

Download
memory/604-57-0x0000000062850000-0x0000000062888000-memory.dmp

Filesize
224KB

Download