2e246d2c173388c3edf19bd9bc5405755b494c64bbefd3d9c8dcba9717209bf7

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 05:22

Target

2e246d2c173388c3edf19bd9bc5405755b494c64bbefd3d9c8dcba9717209bf7.dll
Size

71KB
MD5

522bfba7e390c804528ae76e0c1e70d0
SHA1

25f0742fccef028f621a5317cb1f0c6244d64b85
SHA256

2e246d2c173388c3edf19bd9bc5405755b494c64bbefd3d9c8dcba9717209bf7
SHA512

01d7b2c31b854a849e283d02645d67c81c052de0d27032c83a31154c9edf5b2cf3266f5b23d4df82af3440b289af357d07cdec6471593397e0d617017ca6922b
SSDEEP

1536:pWOT4ZT/92ynJe+k/juExtMODwO6XRHGCDUdE5ctfUsPZ/VbbS:pWO8ZT/9Je+Kjvx+OTmRGCDYJtsWZt6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28
PID 1456 wrote to memory of 1772	1456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e246d2c173388c3edf19bd9bc5405755b494c64bbefd3d9c8dcba9717209bf7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e246d2c173388c3edf19bd9bc5405755b494c64bbefd3d9c8dcba9717209bf7.dll,#1
  2⤵
  PID:1772

memory/1772-54-0x0000000000000000-mapping.dmp

Download
memory/1772-55-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download