da7e9d90078193436aed195e4cfb105c3478791753b0e0f5b0a1b3253eaaac91

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:34

Target

da7e9d90078193436aed195e4cfb105c3478791753b0e0f5b0a1b3253eaaac91.dll
Size

65KB
MD5

4337f897378478fb981a81b0a055527f
SHA1

abb8f72e2624dd9de0a6326ce805f4fb2bf908fb
SHA256

da7e9d90078193436aed195e4cfb105c3478791753b0e0f5b0a1b3253eaaac91
SHA512

3ea8fbd4b07d24fc160a885a190cbd87f1ed5cee83ac7a5b308573be197aee9a96c0c4bcf38a2aea8e3a7036e29c575d4c36f05bd760b37bdd599347732c2b81
SSDEEP

1536:RVPkmGWNhrKURbbcKRJigKuWed+xouX56Jh/Sa:TPGupRogKbE+9p0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27
PID 1444 wrote to memory of 1948	1444	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da7e9d90078193436aed195e4cfb105c3478791753b0e0f5b0a1b3253eaaac91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da7e9d90078193436aed195e4cfb105c3478791753b0e0f5b0a1b3253eaaac91.dll,#1
  2⤵
  PID:1948

memory/1948-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download