893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500

Analysis

max time kernel
12s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:17

Target

893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500.dll
Size

15KB
MD5

866fa13157b29c02e4eb5947496a1c00
SHA1

a359bade8767015a1d6093919e9cb8584702e64e
SHA256

893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500
SHA512

1a84ac16adc6dc6cecfc75c0259fb3eaf0b9521a144e682ea3f6e78d11786e3ab83218b3fbe0f7491b7d6a7ccccc59dc72f17723703666fc7673b89316700456
SSDEEP

384:BIvnxs64eCC+q3kGlhAoNJJn5fNPWGM7xKhAzAp:K5geCG3xlhAoNJJWGMdKezA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28
PID 2028 wrote to memory of 1284	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\893e8d7d99df24d744e40f96c911f5d2066ff009ec4dfe55546f3c0db1753500.dll,#1
  2⤵
  PID:1284

memory/1284-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1284-56-0x0000000075200000-0x000000007520D000-memory.dmp

Filesize
52KB

Download