21c61c6a0da70f2b6d57d8d37a1701a597537e74dbde6ba1eb67af5eb2af3e93

Analysis

max time kernel
14s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 13:25

Target

21c61c6a0da70f2b6d57d8d37a1701a597537e74dbde6ba1eb67af5eb2af3e93.dll
Size

293KB
MD5

0f3733e0f8ac92eb2040c0c5712f3c60
SHA1

691010f7315abb8707b5764790ed6fc0930c44f4
SHA256

21c61c6a0da70f2b6d57d8d37a1701a597537e74dbde6ba1eb67af5eb2af3e93
SHA512

b1511be93ba940a92b8c7f5910f1bfca6b952a99a28ae9ed962e5be176a6fe6d1a0acd221c75177ec37b132e1827f6d095181c903219d156581e9a050785e1d1
SSDEEP

6144:4ZObyhqDyXBp/+rmk/hYvX/4vy4Q9lFJ+96JDPzd/76t:TDQp2rnpYvgNQ9L0y7d/78

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27
PID 1352 wrote to memory of 1320	1352	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c61c6a0da70f2b6d57d8d37a1701a597537e74dbde6ba1eb67af5eb2af3e93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21c61c6a0da70f2b6d57d8d37a1701a597537e74dbde6ba1eb67af5eb2af3e93.dll,#1
  2⤵
  PID:1320

memory/1320-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1320-56-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download
memory/1320-57-0x0000000010000000-0x00000000100B2000-memory.dmp

Filesize
712KB

Download