36e37401f0feef5293c1d302f292dd46c62287c62df71188875836cf7f92e735

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:14

Target

36e37401f0feef5293c1d302f292dd46c62287c62df71188875836cf7f92e735.dll
Size

51KB
MD5

ac346c27c4010af86165c07e8151f2b0
SHA1

5fd80cbbc755dc0461009598441ad20abb9275e2
SHA256

36e37401f0feef5293c1d302f292dd46c62287c62df71188875836cf7f92e735
SHA512

99333bc878ff2fecc017f61d5067f5f289ea808299704002f5c3675bd9e314fe5bfa0d5061efd063986da35affce8aac5e50890543c06e3a9214638484f96c35
SSDEEP

768:Gx4m7JNSll3dTG+DRbzRaTsBpXKSXEan3DZVL8LNvLg/sWmaDQpwwFX5zb:Bm1NGJVGaFzRnBFKLazTANvLks+Dyj/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36e37401f0feef5293c1d302f292dd46c62287c62df71188875836cf7f92e735.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36e37401f0feef5293c1d302f292dd46c62287c62df71188875836cf7f92e735.dll,#1
  2⤵
  PID:944

memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download