dbc4e9c63f4b9ea0794f8ff73423b97a853c96be6b406a76710f8d1433ff789e

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:32

Target

dbc4e9c63f4b9ea0794f8ff73423b97a853c96be6b406a76710f8d1433ff789e.dll
Size

242KB
MD5

da7c1fae0142488a1b30c5d8fe5f6a2c
SHA1

3cfc6cf18bb9585520b2ee6159af45497cfc0dc2
SHA256

dbc4e9c63f4b9ea0794f8ff73423b97a853c96be6b406a76710f8d1433ff789e
SHA512

3b3881eb5e268f0209e6071d728da3f20e2ddc5dbf320cc6cc5892169ac25649e77b50ddf6997d8841b0f2fa33db0e3692891942dbd5067f6bf3bbb669068a7d
SSDEEP

3072:CoyxvfGPCXZsxMeZMN+ckS9drqnS20YVbQ3uiShzulOgvc:CoQfW2ZsSeiLYVCuisOvc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28
PID 1280 wrote to memory of 2004	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbc4e9c63f4b9ea0794f8ff73423b97a853c96be6b406a76710f8d1433ff789e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbc4e9c63f4b9ea0794f8ff73423b97a853c96be6b406a76710f8d1433ff789e.dll,#1
  2⤵
  PID:2004

memory/2004-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download