22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43

Analysis

max time kernel
14s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:00

Target

22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43.dll
Size

196KB
MD5

b407d42c8515b85186dc3591707cd360
SHA1

fe8ba1e82ec2598562003f33376efe3e7f166702
SHA256

22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43
SHA512

581fef3983ad18aa643af196638cd5c93c9d3dda133927be7ad1fef9a87db0b71942a05a910c8a57b66e2bd127e59afe2bdc9c38fbf01a32579176efb40118e2
SSDEEP

3072:skDNwyLv/ENXtvsJgSZZMJwUaK2SL3T7eufp1NQ/gFkUahx9dmyTKgCVZS:skD28nj++UZRrneufVQYajhR9Ko

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22a2225a7f3b17c70d1f7dfab4f2aad3ecef0e9d4bdfb2f4c8ed6a5826632f43.dll,#1
  2⤵
  PID:956

memory/956-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/956-57-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download