83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 22:12

Target

83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552.dll
Size

385KB
MD5

5f56ddda5d5bba9ca0160d1494a509d8
SHA1

8e7c008de6076688aeb1009bf657e855262517f5
SHA256

83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552
SHA512

269a04370cff6ab6e2ee31bc62a5275eb5d9a56f77cf3ea243669673cf1ff09cebe1ab1a5ec08abf09457c6624da8406003a68a9c89353bc2a61d882af08a327
SSDEEP

12288:JzVibTJEu+Q40dTInHYPm14b3XSqSdPsXj:JsJiB0ZIHJ14b3pSg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 576	1420	rundll32.exe	28
PID 1420 wrote to memory of 576	1420	rundll32.exe	28
PID 1420 wrote to memory of 576	1420	rundll32.exe	28
PID 1420 wrote to memory of 576	1420	rundll32.exe	28
PID 1420 wrote to memory of 576	1420	rundll32.exe	28
PID 1420 wrote to memory of 576	1420	rundll32.exe	28
PID 1420 wrote to memory of 576	1420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552.dll,#1
  2⤵
  PID:576

memory/576-54-0x0000000000000000-mapping.dmp

Download
memory/576-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/576-56-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download
memory/576-57-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download