dbc0308f22a77b0efa35aabe9b0c75d51aa0d6cb972e8f3a3283631d47b003d0

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 01:51

Target

dbc0308f22a77b0efa35aabe9b0c75d51aa0d6cb972e8f3a3283631d47b003d0.dll
Size

5KB
MD5

eecf6e032fc0a8aef449cf8b59056070
SHA1

9bfb5e43cd95c887219d2312b126945358b6e6af
SHA256

dbc0308f22a77b0efa35aabe9b0c75d51aa0d6cb972e8f3a3283631d47b003d0
SHA512

53ce311fcf15bc9b8fe7a313db370d77e3a2d5d7ab0e6266e31c2ea34a36b80fdf472313c241b847fb0cd20622b93e1914c8de04303326174c083abe404d6c3d
SSDEEP

48:a5zdM1cSTBg0r27vTuAEKEETf0tQ4uu4YmUfaUJ6rJkg5OlhRK:PT3r2vu9vEotQ4utYVSY6qJlhU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27
PID 1752 wrote to memory of 1720	1752	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbc0308f22a77b0efa35aabe9b0c75d51aa0d6cb972e8f3a3283631d47b003d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbc0308f22a77b0efa35aabe9b0c75d51aa0d6cb972e8f3a3283631d47b003d0.dll,#1
  2⤵
  PID:1720

memory/1720-54-0x0000000000000000-mapping.dmp

Download
memory/1720-55-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download