96714a9dc8530a44afa8c9811cf5d45be7e340f71e2dd7b07a6d9f9932b7c088

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:50

Target

96714a9dc8530a44afa8c9811cf5d45be7e340f71e2dd7b07a6d9f9932b7c088.dll
Size

64KB
MD5

10655d527c2fccf0adedc0842060b639
SHA1

c99061d83a8f87d900bcb9a396cad0c97f9be153
SHA256

96714a9dc8530a44afa8c9811cf5d45be7e340f71e2dd7b07a6d9f9932b7c088
SHA512

1f67f86f748ac1a2c52f5a1040e6a38495bc65c4e48312fdcc8e4d3c8c8b069c2ec0e2c340e9a10fb423fbf8859d94fd485181750cd201db67f2ae73d0bd1c29
SSDEEP

1536:kAVupyFe3hb9MehQ/OQMV3ZJhdfebbknHNM2/P23sqCW/:Ly3hb9rEO3VphYGNM628pW/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\96714a9dc8530a44afa8c9811cf5d45be7e340f71e2dd7b07a6d9f9932b7c088.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\96714a9dc8530a44afa8c9811cf5d45be7e340f71e2dd7b07a6d9f9932b7c088.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1204-56-0x0000000000160000-0x000000000016B000-memory.dmp

Filesize
44KB

Download
memory/1204-60-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download