31a2293947fa76f8d98853cf5a866e55d2419748dc849a1d63739ddcca7b96e7

Analysis

max time kernel
31s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:34

Target

31a2293947fa76f8d98853cf5a866e55d2419748dc849a1d63739ddcca7b96e7.dll
Size

72KB
MD5

d228bb5eaf0f6d53d31d1cd73a6ae460
SHA1

7f7b28b03d43485ddba809c04505bbf982e414d0
SHA256

31a2293947fa76f8d98853cf5a866e55d2419748dc849a1d63739ddcca7b96e7
SHA512

cafe323cacb8f6823129f6ea321e428aac79a0cb386910d09020600eda35e6bed31d7cad3e7db2a50a8c58346c9ca955da149240ec4db63016b1d77b298f11c0
SSDEEP

768:kVeNI3azL75TqfIB0WC9Wc0LUjX1nTLj1nwIF3ENu/9u+:ZKazL75TqfIRZyXFTLjpws9u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26
PID 1720 wrote to memory of 1708	1720	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31a2293947fa76f8d98853cf5a866e55d2419748dc849a1d63739ddcca7b96e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31a2293947fa76f8d98853cf5a866e55d2419748dc849a1d63739ddcca7b96e7.dll,#1
  2⤵
  PID:1708

memory/1708-54-0x0000000000000000-mapping.dmp

Download
memory/1708-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download