c14acac864975351f1e887b5191af07b8c7a57b9b9788fc25d0959b0b6f53b02

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 23:12

Target

c14acac864975351f1e887b5191af07b8c7a57b9b9788fc25d0959b0b6f53b02.dll
Size

37KB
MD5

8d683c97f21dc86f651804bf349fc4e2
SHA1

52f2e7ca52b819fb5592f337e814878e405e9495
SHA256

c14acac864975351f1e887b5191af07b8c7a57b9b9788fc25d0959b0b6f53b02
SHA512

f05f96746d8e4763d07aa9ac9ec95a14db77a907a09d76e27ce0b83a5a6e101cfbf8a97679a31a6c66304847c155764e8dec8b4a50acce477ae8d07eded883f7
SSDEEP

768:0phhSLBqV6D/ZHEjMj4ags+XLto6feVCrmKUnLeKireD6l4ODukz9qdW6:0phhl4Z4a4to6mQGKKy66+ODZ9U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27
PID 1148 wrote to memory of 548	1148	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c14acac864975351f1e887b5191af07b8c7a57b9b9788fc25d0959b0b6f53b02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c14acac864975351f1e887b5191af07b8c7a57b9b9788fc25d0959b0b6f53b02.dll,#1
  2⤵
  PID:548

memory/548-54-0x0000000000000000-mapping.dmp

Download
memory/548-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/548-56-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/548-57-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/548-58-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/548-59-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/548-60-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download