ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 23:48

Target

ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b.dll
Size

85KB
MD5

412c75d167df7e685351426208d728c6
SHA1

6bbcab33d4426d5d0281bcd4b27c04b9e480ed6c
SHA256

ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b
SHA512

5916f22b4d521e8437f78431de153ed6f4a2a57a28579bf8145ea1125bca9fd9598519f5b08ddd5ed92821997232541e141f6a4d7de0b956380fcc7a1f6d8638
SSDEEP

1536:Kz9eMFttJVexWngWCvvRXXWYF4qpTPJ7taa3tdWx23HJMCLg6MAxYmImp2H7fjaT:SrIECdRCMTPJ7NdWx2XJM9XKIJ7fjpmN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28
PID 1904 wrote to memory of 1604	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad4d15220415a26a86d449bea514faf802b70554ff3577e6e9115c164534209b.dll,#1
  2⤵
  PID:1604

memory/1604-54-0x0000000000000000-mapping.dmp

Download
memory/1604-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1604-56-0x0000000000160000-0x000000000019F000-memory.dmp

Filesize
252KB

Download