34e440777796804323a3a61693583f3a1f2096e44ba5929ea0b45fee79007afe

Analysis

max time kernel
36s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 05:10

Target

34e440777796804323a3a61693583f3a1f2096e44ba5929ea0b45fee79007afe.dll
Size

100KB
MD5

a6669a8388969d3cd1296fd02838ec90
SHA1

81dcbde91daa9b258837cd9f6af466eb46d2caa6
SHA256

34e440777796804323a3a61693583f3a1f2096e44ba5929ea0b45fee79007afe
SHA512

0c012afeeccab45b892f3f781bda3da1c8affa1b7a77d15543a1f32c0fd30bb9af857ad51dc36321691eb28659a265ef12851c04d10116358b4f8d3f5db8ca7c
SSDEEP

1536:8K51R5eWX2vQu1pOQHkckV0ZB0O/R444MLNH5Ir96BzNCpXV3:557b+QuCCkLV0H0oJ4OnCpX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28
PID 960 wrote to memory of 952	960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34e440777796804323a3a61693583f3a1f2096e44ba5929ea0b45fee79007afe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\34e440777796804323a3a61693583f3a1f2096e44ba5929ea0b45fee79007afe.dll,#1
  2⤵
  PID:952

memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/952-55-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download