6936a439624699ab5a6c59b9b800ce4f726580b2fd3acd59d183906d9ec43199

Analysis

max time kernel
12s
max time network
98s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 00:30

Target

6936a439624699ab5a6c59b9b800ce4f726580b2fd3acd59d183906d9ec43199.dll
Size

43KB
MD5

87c6ecc6df04a0ec838bec1563592818
SHA1

5ea064fdb05c300af93fcf59cda92ba107b95a06
SHA256

6936a439624699ab5a6c59b9b800ce4f726580b2fd3acd59d183906d9ec43199
SHA512

b6190bf20abe9a8084cdafd3e1c9f14190a48066017111631242d2b1bb1563bcb8f44fee379b2326da30f7dd36a179869781668ff95ed335e0c4e27061a97a35
SSDEEP

768:wuc+tv/Tr6CBmVGg+dbCm+7//ZHvrtRvOeKrIKrQfR1Kf4io9dH2:wf+tv/Tr6CBMoKHvRR2jhLdonH2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6936a439624699ab5a6c59b9b800ce4f726580b2fd3acd59d183906d9ec43199.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6936a439624699ab5a6c59b9b800ce4f726580b2fd3acd59d183906d9ec43199.dll,#1
  2⤵
  PID:2008

memory/2008-54-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download