9683402afebc31607969efe675a6827684addbaad2dccf85c38f28ccb7ed134c

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 21:25

Target

9683402afebc31607969efe675a6827684addbaad2dccf85c38f28ccb7ed134c.dll
Size

221KB
MD5

974c30682e44447255e6fd3258a4f7bb
SHA1

aadc84edea4131119286026e8224d425f324ab67
SHA256

9683402afebc31607969efe675a6827684addbaad2dccf85c38f28ccb7ed134c
SHA512

344312f83c371d2edc908323f36f6d39726a8db9df41f2f5772ee80a387a8c2ee7d9d0907d8b9fe07b0c8c4507e1fbce80b6e1a3ecfc7e1e9c37487946196c6d
SSDEEP

6144:pZJt7PKJ4gJkYB2DMBHuHt4ooyNatqkKdHetO0pL31z1zRGMk:pLQ4gJZ2DE6Z1NatJuJ0pL31NUz

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 2036 wrote to memory of 1852	2036	rundll32.exe	28
PID 1852 wrote to memory of 940	1852	rundll32.exe	29
PID 1852 wrote to memory of 940	1852	rundll32.exe	29
PID 1852 wrote to memory of 940	1852	rundll32.exe	29
PID 1852 wrote to memory of 940	1852	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9683402afebc31607969efe675a6827684addbaad2dccf85c38f28ccb7ed134c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9683402afebc31607969efe675a6827684addbaad2dccf85c38f28ccb7ed134c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:940

memory/1852-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1852-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1852-57-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1852-58-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1852-59-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1852-60-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1852-61-0x0000000000180000-0x00000000001BF000-memory.dmp

Filesize
252KB

Download
memory/1852-62-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1852-64-0x0000000000180000-0x00000000001BF000-memory.dmp

Filesize
252KB

Download