33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb

Analysis

max time kernel
19s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 05:15

Target

33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb.dll
Size

141KB
MD5

41bac8bf71a7a22f01bf005d81e52826
SHA1

b4a9799588b709596add37b2ab4469aa718ab4e7
SHA256

33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb
SHA512

4d0582a381e3811ebb8fc036cc253b3018880dbbbf2e255707646a32f6733de7206226cd2c0e7c006277e571ea9c2eee91efc8f7c072970f82133aa870fbd71e
SSDEEP

3072:5ECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:5EvgOP17s/F08OaoCC1vl1V

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28
PID 1260 wrote to memory of 2012	1260	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33336fb2226575d1d7ee1c92aa7d30c4dc7eed22261bd42741ced0a5349dcdfb.dll,#1
  2⤵
  PID:2012

memory/2012-54-0x0000000000000000-mapping.dmp

Download
memory/2012-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download