956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 04:34

Target

956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab.dll
Size

36KB
MD5

ec53bf65cb035733fb1413de64c12a72
SHA1

fc79a3d7012b6d30f0069ac0cb66429fa1df24e2
SHA256

956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab
SHA512

e3401205beb9eb0d9920ed3068da79c04c780efbba9f9aead7e2558e0b8f271b62754eead13720c8345b32ac37248c843e68c7afb902ab1f8d72f5eee48e4c8f
SSDEEP

768:7mWtf1lkAzsDbNNO+Ba0Z/7MQiSyCLvH/CODbhTR+6Q:7l1lkwK3O4aW7MzSzLvKOhTR+6Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27
PID 1636 wrote to memory of 1712	1636	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\956ffb4f6488f3a3d42347bb93d093936e7372b496694968ea1dc8afea7dddab.dll,#1
  2⤵
  PID:1712

memory/1712-54-0x0000000000000000-mapping.dmp

Download
memory/1712-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download