c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 16:11

Target

c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce.dll
Size

674KB
MD5

a4c92562304c3d01be3b25c1ac7ce93b
SHA1

1033022b9f51c427ea702b883096bbe023e20282
SHA256

c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce
SHA512

ebc5dc9e8369fabb6e1574602055b6ec2c32377bd7315816e0b28edc8b59e44810e206aa2d1cf1d89ce2f2fa20c02a66257966a3d957bf6a7e41be75183a4b61
SSDEEP

12288:Zmk8mDyLRPH9Dsm3QmRm/wj8xcGOYXHjDzj60zY1sIjsWVgm7DzVzIwC:Mk8mDyLpdDsm3QJ/wYxcoXH/6kY1HjnW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28
PID 1456 wrote to memory of 1928	1456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4d201b84c67dcecac797799667cb8a0cf1fbd20ca02415ee28fae2254d083ce.dll,#1
  2⤵
  PID:1928

memory/1928-54-0x0000000000000000-mapping.dmp

Download
memory/1928-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download