26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797

Analysis

max time kernel
32s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:24

Target

26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797.dll
Size

161KB
MD5

8a9d0da64e5dc18dd5d0a8492b72b28c
SHA1

b797181f840899cf2eb240e20814d95fedc5cb88
SHA256

26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797
SHA512

ef7f59ed010686e316478f4953c1067f28db117ed2c11f7fadcd5ef8601f4f3518767c8d07b1503929d4b36ffd0f8255465fab9bd079d5cf5b2f883d9e2d705e
SSDEEP

3072:Y0aK/6Ue1rR1gxZR+V3TzfOIsUgpSYISpUDHHf5X71B:La9rJR1gxGVDDOIsUgMYxpQHHZZB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28
PID 1932 wrote to memory of 2008	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26601d979677937f58070a7d459881a826d89e7b4901d50c3bcf85fbe50c8797.dll,#1
  2⤵
  PID:2008

memory/2008-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download