85b52ee9fed42de60c1ebb7e6ba3acea8d8ce9ac18caa47945b737cd91cce5f0

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 11:23

Target

85b52ee9fed42de60c1ebb7e6ba3acea8d8ce9ac18caa47945b737cd91cce5f0.dll
Size

144KB
MD5

92b74ee59014d041a60d3177ef3b4666
SHA1

8e291695995c444bb54f78f860d86c594c361dc2
SHA256

85b52ee9fed42de60c1ebb7e6ba3acea8d8ce9ac18caa47945b737cd91cce5f0
SHA512

c3fadd1a0cf77c4b2313d287ac4631bb4aa7905d736fccd22102f99f9e96993b10ae1180ae366b2838b29b68abfc7d3e268f1ce9865d823ead6fc5bb4463a299
SSDEEP

3072:z2JFobwTrk1zZqGiLn5JqgavZ+VqXXFt25/MYSiJmMSDcmmHpL:CJFobwTrk1zZJiL5Jqga4VC1iJmMUmJL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27
PID 1408 wrote to memory of 1456	1408	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\85b52ee9fed42de60c1ebb7e6ba3acea8d8ce9ac18caa47945b737cd91cce5f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\85b52ee9fed42de60c1ebb7e6ba3acea8d8ce9ac18caa47945b737cd91cce5f0.dll,#1
  2⤵
  PID:1456

memory/1456-54-0x0000000000000000-mapping.dmp

Download
memory/1456-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download