a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:55

Target

a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c.dll
Size

171KB
MD5

a3db9a88a3862df24c0527a73e0303c4
SHA1

13cd97bb2928e8aab5f36429ba52446548792f30
SHA256

a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c
SHA512

94b698a6a36553a2796f4c241006c01978b09cac81c2fef2ef4dba788e01759b424f57ce176631ece9382d3ff5eb882df77853a71b1e0535460b3c0536760d1d
SSDEEP

3072:p8/NbdCGRtFq1zkuPczNslVnv70dWg6YIKOGBgmMMmq0yiF5y:p8VlRK1Aal5KWg6+BgmMVFT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c.dll,#1
  2⤵
  PID:1456

memory/1456-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1456-56-0x0000000000200000-0x0000000000219000-memory.dmp

Filesize
100KB

Download
memory/1456-57-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download