47940a06ee4755d3cd31900683b3ddee5172682fde2e6e197ee4b82da8398c1f

Analysis

max time kernel
3s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:24

Target

47940a06ee4755d3cd31900683b3ddee5172682fde2e6e197ee4b82da8398c1f.dll
Size

102KB
MD5

be9c66cc09df47e76ed350db25eabbe0
SHA1

431dc8439223bf8f16d116a180ae63487d0535b3
SHA256

47940a06ee4755d3cd31900683b3ddee5172682fde2e6e197ee4b82da8398c1f
SHA512

af9f59735a88459b8ee09936280be1359f4597083c020c6052a8a6a94e560509b3f9ceb873ea14c55173a1d087a9569111cb144e9db5cb26db4c81d76ce1cdba
SSDEEP

1536:P3qFQTo/izrNdgzmcDQNzDxWQ+PnNwks2O30bBaNmpLy/5:eSo6zrMCc8NzNWQ+PnNwDAbBawpLyh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28
PID 1380 wrote to memory of 1400	1380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47940a06ee4755d3cd31900683b3ddee5172682fde2e6e197ee4b82da8398c1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47940a06ee4755d3cd31900683b3ddee5172682fde2e6e197ee4b82da8398c1f.dll,#1
  2⤵
  PID:1400

memory/1400-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x0000000000121000-0x0000000000133000-memory.dmp

Filesize
72KB

Download