958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:59

Target

958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26.dll
Size

59KB
MD5

b3b0d1da7be2df771c42ca8681d70a05
SHA1

fc505fe10fa53d1b9bc35efb8aacecd37608b522
SHA256

958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26
SHA512

1fe2cef04c19df43c6bfaeb7736f48084537bfbfdad988d745efa60d987696db4526c1cf09ae79f5ced010fdc4b338ab9c0b581891f2dfeec249b8e82dd7e908
SSDEEP

1536:MhBRVgrExucM30zPraCPMkdspSk2BERb/7btIGgRQV4:cRRst07WCkk22GRb9IJ44

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28
PID 2028 wrote to memory of 2040	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\958361a02d0f1e4b729b3928b1568b42f1e3b04c6717c603a38bacbee0f04d26.dll,#1
  2⤵
  PID:2040

memory/2040-55-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download