41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:54

Target

41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e.dll
Size

54KB
MD5

671e2be09abadf3cf0e4c51111988cca
SHA1

30e69d15fdc248fca17f47cae699784e333fb96f
SHA256

41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e
SHA512

c2ff0acd6b6aed54d652f850899e0df94c6c6737b0b2f7f53be39e45e175797c64870f7c9cab34ae268e462c4f7473e57d0b6f0ab3e8afa4e35da072dc22480b
SSDEEP

1536:BfQAl+7ovOlpRq7wJ9r26enO2QnMbKFmsWT:dQAl+pbM7OudQn6KFmsWT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27
PID 2028 wrote to memory of 1388	2028	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41992610b379ec70107bda9bea5269b5f87c0aabbe5db5d98f387b5364166a5e.dll,#1
  2⤵
  PID:1388

memory/1388-55-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download