f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 11:16

Target

f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47.dll
Size

12KB
MD5

71ad82e89d4b6917b2a29b24dce2ed10
SHA1

58844553fbb366c37540c6a2d5b6dfe73568993c
SHA256

f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47
SHA512

07351a419acfc152f3a7f8b814b0346e82b60b1004a5432f65aa5fec454cb1bc0daba14e971ee1eb81ab4d8f543df970af70a0823f44d856be66e74cba033b6c
SSDEEP

192:WiAo/d/ftODI5bLwlkljKWDWupfielRrMpwabuKW+4DtyQ:WfGpff5b0lkdKWDWupfielRrM7bhW+4/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27
PID 1716 wrote to memory of 1220	1716	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37944b97d05b9432adb10ce21283161edeb5d0953519fa8ce5cd8d874be6a47.dll,#1
  2⤵
  PID:1220

memory/1220-54-0x0000000000000000-mapping.dmp

Download
memory/1220-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1220-56-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download