d249ab375cd484dac33b3d33d7fd81f29e14cd6f132961ad3ee8539d41518052

Analysis

max time kernel
224s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:37

Target

d249ab375cd484dac33b3d33d7fd81f29e14cd6f132961ad3ee8539d41518052.dll
Size

42KB
MD5

d278e105d4e0408431478e92d1307be7
SHA1

7d5381fe0b9dcb2ab28bd56e39d4c17943d0ade2
SHA256

d249ab375cd484dac33b3d33d7fd81f29e14cd6f132961ad3ee8539d41518052
SHA512

99809ec69482fe0094018fef264c7ab1f4fd76defdf13c8559fb2d2776e1564085808f25cd96f169bd6b1d4923e6496987b8346c0aae42dd5dd574727ea97b49
SSDEEP

768:TSOasEyih9crIJVjHWgzu74rKDx7fBt7RihtgcPpPJHzWBoR87+e:TSrsPe9cYXS74rKtVt7RicIdaoR87z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1032	860	rundll32.exe	28
PID 860 wrote to memory of 1032	860	rundll32.exe	28
PID 860 wrote to memory of 1032	860	rundll32.exe	28
PID 860 wrote to memory of 1032	860	rundll32.exe	28
PID 860 wrote to memory of 1032	860	rundll32.exe	28
PID 860 wrote to memory of 1032	860	rundll32.exe	28
PID 860 wrote to memory of 1032	860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d249ab375cd484dac33b3d33d7fd81f29e14cd6f132961ad3ee8539d41518052.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d249ab375cd484dac33b3d33d7fd81f29e14cd6f132961ad3ee8539d41518052.dll,#1
  2⤵
  PID:1032

memory/1032-54-0x0000000000000000-mapping.dmp

Download
memory/1032-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download