b91656bfd18aca56883a37f5f18ca2b6d1a66bd861c0d5653e25ff8c5f9c0a2c

Analysis

max time kernel
17s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 18:51

Target

b91656bfd18aca56883a37f5f18ca2b6d1a66bd861c0d5653e25ff8c5f9c0a2c.dll
Size

110KB
MD5

caf69dd72ac1a622a75e43c303fc8e76
SHA1

84e59af45d37240042cedcafd49d30f4e9f02c5b
SHA256

b91656bfd18aca56883a37f5f18ca2b6d1a66bd861c0d5653e25ff8c5f9c0a2c
SHA512

4d6df6f23d9fbfe18d376e952f3e8801e948b1723516d2faca4159dcb19165692d966e5f884bd35be4b113a35bd9ab9bb44557725f7e65696591fa7b98b5ee72
SSDEEP

3072:1zIXRjOBkKYxWW8KF5PHBvpeQss9Rtq28hj3Hy:lIXRjOBkrT8Y5PhkRs9T

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27
PID 1208 wrote to memory of 1144	1208	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b91656bfd18aca56883a37f5f18ca2b6d1a66bd861c0d5653e25ff8c5f9c0a2c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b91656bfd18aca56883a37f5f18ca2b6d1a66bd861c0d5653e25ff8c5f9c0a2c.dll,#1
  2⤵
  PID:1144

memory/1144-54-0x0000000000000000-mapping.dmp

Download
memory/1144-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1144-56-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/1144-57-0x0000000000180000-0x000000000019F000-memory.dmp

Filesize
124KB

Download
memory/1144-61-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download