99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba

Analysis

max time kernel
131s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:52

Target

99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba.dll
Size

26KB
MD5

03351d647751e186c7e695e72affbdd2
SHA1

a1fb84df0fb29cd0b99454e6f21a98444a7dccbc
SHA256

99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba
SHA512

21e899863f9860818d10b525bbb557763c4cdcffbdff7576cc7af099d6c31a12edeba89a44858c964ba22c6f15177ee027db90bc4b252944123775b2012a3db9
SSDEEP

384:I+ERmc8QDnRGNZll0cRCJXEt/LgnWE7dZxFdzkuq//x2hFiqI0ooNG8XRZdd:Omc8aniZo8jGD7dH2sVnXRZdd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28
PID 1356 wrote to memory of 1360	1356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b89003de2690169187afae23de8144f932fe0b1dfc64b5f5e1b1a2b6610eba.dll,#1
  2⤵
  PID:1360

memory/1360-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1360-56-0x00000000749B0000-0x00000000749C1000-memory.dmp

Filesize
68KB

Download
memory/1360-57-0x0000000074990000-0x00000000749A1000-memory.dmp

Filesize
68KB

Download
memory/1360-58-0x00000000749B0000-0x00000000749C1000-memory.dmp

Filesize
68KB

Download