41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 11:18

Target

41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2.dll
Size

121KB
MD5

e39575a7c4379e1dbd3fe248723c50b0
SHA1

282bbc460087520cd15e8e0c6cecd146c40853b7
SHA256

41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2
SHA512

86e03ed411dfee09830652133d370c7e043a3a5e36d3e36ea9c79b39b4020e9470d8bced4328f61ef1ee67bbb4390ff1522ce7996917de45fd7696eb3aeec810
SSDEEP

3072:4FoQaBWdMHJNsuNjfQU0OhgH0TNsgWPPLdpBj5RFY:4FoQJMEuuihGuNs1PPLdpBj5w

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26
PID 1976 wrote to memory of 2024	1976	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cca5030c41df306a718918007e2234ff6d31baac2883ae0d8df92e75649bf2.dll,#1
  2⤵
  PID:2024

memory/2024-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download