72131747622af827acc25a9224030a31e5945f279d672c8d839a96be22b337d2

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:10

Target

72131747622af827acc25a9224030a31e5945f279d672c8d839a96be22b337d2.dll
Size

359KB
MD5

0ecb56e91e7c296af207bf2326755a50
SHA1

bbf160e898a472f2385000eb8ad50a21c4c9b0a5
SHA256

72131747622af827acc25a9224030a31e5945f279d672c8d839a96be22b337d2
SHA512

e9636a55214faa82266908a04c99b5fab39d404cad90aa9ab782479a7a780cf46297bfdaf3f672847d7c308f50280f376cfe68f9736e9c0ffafb3f6e24cc0e1f
SSDEEP

6144:BwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:CkI4nJmRz9PGGjkrgoN9Ppymfkn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28
PID 1928 wrote to memory of 1500	1928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72131747622af827acc25a9224030a31e5945f279d672c8d839a96be22b337d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72131747622af827acc25a9224030a31e5945f279d672c8d839a96be22b337d2.dll,#1
  2⤵
  PID:1500

memory/1500-54-0x0000000000000000-mapping.dmp

Download
memory/1500-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1500-56-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download
memory/1500-57-0x0000000073E71000-0x0000000073EC6000-memory.dmp

Filesize
340KB

Download
memory/1500-58-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download