107b61766561d5191f1a72209987b400ba7b0e425aa6d0db6b9ad4fb22408d0b

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 06:38

Target

107b61766561d5191f1a72209987b400ba7b0e425aa6d0db6b9ad4fb22408d0b.dll
Size

137KB
MD5

73613cb97406f5d1ae2c532fa815d800
SHA1

b676ba49039de2e678232efafb39707843d3ea63
SHA256

107b61766561d5191f1a72209987b400ba7b0e425aa6d0db6b9ad4fb22408d0b
SHA512

b2e0eec08fd0450e58c67984f756507ade38ccd7767476b0a86509df6158099bfb07f7f26f109c42494a8f4c5c73421b2d335d4aab61a1c7af54a0a3be036fa4
SSDEEP

3072:C8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxc0ILR:C8w6D4Kotup0LWI+f2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\107b61766561d5191f1a72209987b400ba7b0e425aa6d0db6b9ad4fb22408d0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\107b61766561d5191f1a72209987b400ba7b0e425aa6d0db6b9ad4fb22408d0b.dll,#1
  2⤵
  PID:1344

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x0000000000180000-0x00000000001AB000-memory.dmp

Filesize
172KB

Download