d79d67b24798de1399945bd908f6e4ebc05aff23c5972460fb4a8582fc5a74e0

Analysis

max time kernel
2s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 03:59

Target

d79d67b24798de1399945bd908f6e4ebc05aff23c5972460fb4a8582fc5a74e0.dll
Size

628KB
MD5

181490c62f894b298a46f0a980b5de90
SHA1

4811e3c5456356faac220ab79c1a69d787640709
SHA256

d79d67b24798de1399945bd908f6e4ebc05aff23c5972460fb4a8582fc5a74e0
SHA512

64d68bd245e6dcfeb9fab0db035fac7578454437f4435daa66d0a6a508bcf6cbbc5ec3d8b4c3eab60a513d8d5527620360cea343731d1a1ce3117f297eecac60
SSDEEP

12288:PU2QUJlBnjckbJAs28phVsW8Kp9niWxDZvNEdURC395yyIK0whq8Iv:PmCWOPVQ9WxDZSdwCniwBIv

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2036	936	rundll32.exe	28
PID 936 wrote to memory of 2036	936	rundll32.exe	28
PID 936 wrote to memory of 2036	936	rundll32.exe	28
PID 936 wrote to memory of 2036	936	rundll32.exe	28
PID 936 wrote to memory of 2036	936	rundll32.exe	28
PID 936 wrote to memory of 2036	936	rundll32.exe	28
PID 936 wrote to memory of 2036	936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d79d67b24798de1399945bd908f6e4ebc05aff23c5972460fb4a8582fc5a74e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d79d67b24798de1399945bd908f6e4ebc05aff23c5972460fb4a8582fc5a74e0.dll,#1
  2⤵
  PID:2036

memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download