77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c

Analysis

max time kernel
54s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 02:54

Target

77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c.dll
Size

57KB
MD5

b404d23704dddccf2c530d9c14997938
SHA1

5ce400c20c632b19abdc75f29f19185ab5d85da5
SHA256

77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c
SHA512

3480d7f68077a6f1637775e20d39a267279ed82c9a0467c460fcee0f8ff156e0ff04282628869bf6823b2023ebb5bb1f7f445dae610ec243e22b48c2a4d27312
SSDEEP

1536:kNIKDv4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:5qv4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28
PID 1448 wrote to memory of 1124	1448	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77cd1002a88ed48117ee416ff476da64e1d186a8b796997880f3da9b1fb7140c.dll,#1
  2⤵
  PID:1124

memory/1124-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download