386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:21

Target

386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1.dll
Size

56KB
MD5

61949170455fbedfcb65569a00a66ba0
SHA1

675ff23c0b132975d93491519e015ec549412ac2
SHA256

386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1
SHA512

eebb290b2ddeb2869aa8280f03c2d8c57db6d2b0b54a89dcaff0b36ed5b977fd29da596d74ab05b003c1c2f262dc8caa15c2ca5d9fb13094b779baad7f5fc51a
SSDEEP

1536:Bm1NGJVGyU/TL7nLAK8Acb69vIL2zH+ZcyWSetzIu:kX0VDU/TL7nLub+vICYT1u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28
PID 1352 wrote to memory of 1668	1352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\386ce12c412744e9d1e846c4479eee045b0d6270debcac00c034c8708bb9b9c1.dll,#1
  2⤵
  PID:1668

memory/1668-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download