9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6

Analysis

max time kernel
136s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:21

Target

9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6.dll
Size

229KB
MD5

e38f362e49d134aadf6c6af65287017f
SHA1

a42a0f623ed7630a684fa34a7807da0fe29323dd
SHA256

9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6
SHA512

6b7f4341595eb6294f2fa755909537487fd414a1bfa560809fd5955ca22c3d215e97aeaf480cdc72e1d5662c93258632a27deb66a59883d0705b6b5e0d195ed4
SSDEEP

6144:DbDIxbMkCuC/tObjxDfI9QhLg1lFDBPetoVSl1B:vDwbMkCuHFmQhLg1lF9PEok9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27
PID 1324 wrote to memory of 1808	1324	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fd3b62b51c93982ef86c21cf113454fb6ec8b0d8d6b95e3688702efbb688fa6.dll,#1
  2⤵
  PID:1808

memory/1808-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1808-56-0x0000000000700000-0x0000000000745000-memory.dmp

Filesize
276KB

Download
memory/1808-60-0x0000000010000000-0x0000000010045000-memory.dmp

Filesize
276KB

Download
memory/1808-61-0x0000000000230000-0x0000000000268000-memory.dmp

Filesize
224KB

Download
memory/1808-62-0x0000000000230000-0x0000000000268000-memory.dmp

Filesize
224KB

Download