397e5d3362fba813325559e19148910312d2b842e3cd01dbe0dfb329ed24f73a

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 19:38

Target

397e5d3362fba813325559e19148910312d2b842e3cd01dbe0dfb329ed24f73a.dll
Size

58KB
MD5

e627ecccc7611d6dd773c1f8a356bee0
SHA1

e78d7e50481be6e41bd57f17097b21b3597e5a79
SHA256

397e5d3362fba813325559e19148910312d2b842e3cd01dbe0dfb329ed24f73a
SHA512

dc82969ab0d160e07704c2d1c79c8a47e25bff36fe104829a4c16a13e34bbef399b3df6d9c3c9536ef3b591883443120e9c681f06d3f64a5a72e07fc6af0cb0b
SSDEEP

768:h8WTpVT0X8zbtZOFxzgJCvhB4WUT0ureJN8pC+x1KUvLW8IawGh7K8PMTmpnH3F:RVx8xsJCvTAiNor1KIq5ihuNTO1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28
PID 1632 wrote to memory of 1736	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\397e5d3362fba813325559e19148910312d2b842e3cd01dbe0dfb329ed24f73a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\397e5d3362fba813325559e19148910312d2b842e3cd01dbe0dfb329ed24f73a.dll,#1
  2⤵
  PID:1736

memory/1736-54-0x0000000000000000-mapping.dmp

Download
memory/1736-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download