869b5c86489ac1e9a373535149691b121d7994f0a047a41723e161c9656f1a14

Analysis

max time kernel
225s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 01:46

Target

869b5c86489ac1e9a373535149691b121d7994f0a047a41723e161c9656f1a14.dll
Size

100KB
MD5

9b91edde0b89842c0e6fc0ec69b8ef36
SHA1

bee3a30cbdea89b88727f82968d2c42f48883533
SHA256

869b5c86489ac1e9a373535149691b121d7994f0a047a41723e161c9656f1a14
SHA512

c57b347e1dc02d2faf4e1d3a450e3c04aa0d4fbcaa6fccb379b2204743b9597d2449b552c2ee3e7cdf8327d06da5a15273b00214227e7365c3bd21014fb21a98
SSDEEP

3072:ol7Vt2ChrKgCWf3Itf3HVsMBCxn5R8ZEXz:QUErssI1VLBCp5cE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1344	472	rundll32.exe	28
PID 472 wrote to memory of 1344	472	rundll32.exe	28
PID 472 wrote to memory of 1344	472	rundll32.exe	28
PID 472 wrote to memory of 1344	472	rundll32.exe	28
PID 472 wrote to memory of 1344	472	rundll32.exe	28
PID 472 wrote to memory of 1344	472	rundll32.exe	28
PID 472 wrote to memory of 1344	472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\869b5c86489ac1e9a373535149691b121d7994f0a047a41723e161c9656f1a14.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\869b5c86489ac1e9a373535149691b121d7994f0a047a41723e161c9656f1a14.dll,#1
  2⤵
  PID:1344

memory/1344-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000000160000-0x000000000016A000-memory.dmp

Filesize
40KB

Download
memory/1344-60-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download