091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:42

Target

091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6.dll
Size

255KB
MD5

7ea96120bb6a3c405c335aa1812c6ec0
SHA1

3660a4d2dbb699e75278b15b46b074066d471071
SHA256

091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6
SHA512

b1bd68e48fbe05eff8439b3cdd2776a7946e35e773d80b15a08a149ecbb2ee0d0955f1282bbb6c826067ea8e35fc762c822efe25115aa8fb71c3661896cc05cb
SSDEEP

3072:tQZX4vr1VAw0AWfdN2AGTVyLi5ETDG642LD9gZoyJQkCtWPnOdX:tQZX4vrBPLRvQkKWP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27
PID 2024 wrote to memory of 980	2024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\091381a836ccb21deaa9a059830712237886785cdd5fdcdfb3e0d22f153cfbd6.dll,#1
  2⤵
  PID:980

memory/980-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/980-56-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download