acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c

Analysis

max time kernel
18s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 16:47

Target

acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c.dll
Size

173KB
MD5

f39252cefe7d334d80b7c3935d17420a
SHA1

e5f07cac8da5772e6d4b3f67c893ad88ad688b9e
SHA256

acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c
SHA512

02e0c208f8f2edb91003ab4c3f162c0f7d3969627d5cc4b8192a1505fc9e77701b03444f9bd81e043242d5f8980fab54189c6d363e7507d10154826c3eb8c424
SSDEEP

3072:XeZeKyJbvN/dSqA2xReFURUdXE3eXuOfO1LJW4LTkyagDic9/baswYzL/m18p:XeZby9N1SoeGCdXErAO1RLLWswYz3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28
PID 2036 wrote to memory of 1728	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acb2aa862a667a4e51d1030cfe0b00b5db8d199b3fbd2cf35391b0ffb2a92f2c.dll,#1
  2⤵
  PID:1728

memory/1728-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1728-56-0x00000000000B0000-0x00000000000C7000-memory.dmp

Filesize
92KB

Download
memory/1728-57-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download