076ca8b94f8dfebe7fee62aa92ebb97d2aeee1cfde4d20cce86294e116140a93

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 06:16

Target

076ca8b94f8dfebe7fee62aa92ebb97d2aeee1cfde4d20cce86294e116140a93.dll
Size

101KB
MD5

90412729beed1df1edb0bca6a8b85750
SHA1

074dc0014e4453cf43ddad506776b11ba646f41b
SHA256

076ca8b94f8dfebe7fee62aa92ebb97d2aeee1cfde4d20cce86294e116140a93
SHA512

4394b88bdfbdd09be7d17af29e163f5dd5a5dd8954da92492b766da2fe2982ccd23233fe1394937d28d58e4e7a82f7c0da3fd37b62a82bb993d6c3ccbc2b67b2
SSDEEP

1536:nTaiFQ2KveP+SeiIPdX7ewNoupwnw6ie34t9tYUw6Y4K:TaiFQmEdX/Jj6iY4t9tPYl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27
PID 1900 wrote to memory of 1692	1900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\076ca8b94f8dfebe7fee62aa92ebb97d2aeee1cfde4d20cce86294e116140a93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\076ca8b94f8dfebe7fee62aa92ebb97d2aeee1cfde4d20cce86294e116140a93.dll,#1
  2⤵
  PID:1692

memory/1692-54-0x0000000000000000-mapping.dmp

Download
memory/1692-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1692-56-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download