690b828cda7e074f93844613a2b8e28845ae12993877e71b6eff728457a26b86

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 10:35

Target

690b828cda7e074f93844613a2b8e28845ae12993877e71b6eff728457a26b86.dll
Size

30KB
MD5

b81234b77efbba2d022cca17801b8c60
SHA1

4e3dce5ef1c1c130fb6d30571dedaea3e8eb5d38
SHA256

690b828cda7e074f93844613a2b8e28845ae12993877e71b6eff728457a26b86
SHA512

30c6d76d1b993b56ddef24ccf251c619e8f247cc358dc9b22b49d4b6c82d80ebe3902552338d0ed4f82cc045e906f53b3686ccdcaaa0553dc1127d7f4800106b
SSDEEP

192:VRRQmkmHk+NIlKa1O0xMtMNwbHEcvTt10vWjEgeDNI:VRPkGkDKWO0YJjEAD0+wgeB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28
PID 1656 wrote to memory of 1108	1656	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\690b828cda7e074f93844613a2b8e28845ae12993877e71b6eff728457a26b86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\690b828cda7e074f93844613a2b8e28845ae12993877e71b6eff728457a26b86.dll,#1
  2⤵
  PID:1108

memory/1108-54-0x0000000000000000-mapping.dmp

Download
memory/1108-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download