80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45

Analysis

max time kernel
57s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 13:08

Target

80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45.dll
Size

119KB
MD5

6183062036e91b2fad07f06e44852ede
SHA1

a71bfcc486325886ac3e5c0eac90e6380f911a58
SHA256

80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45
SHA512

c647ffc66eb65b6ad246eb696d4daca6ef3d37569682683de93df82860276f5cbf7717954c27672cc3b636dc18cdb17cf57ba7a2717fdd554006804fc9bd70ea
SSDEEP

3072:lozs8Yk8PLCiqiVlyCPZzJy5zAW71id31UlD4xpmPGPIYiRD2dZ:msH5VlyCzc+ccElDIZi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28
PID 1508 wrote to memory of 1552	1508	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45.dll,#1
  2⤵
  PID:1552

memory/1552-54-0x0000000000000000-mapping.dmp

Download
memory/1552-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1552-56-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download
memory/1552-57-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download