d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 11:27

Target

d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c.dll
Size

275KB
MD5

4bbb3ec728616892be40fe43f34ea281
SHA1

8b011bb074fa6981de18a00ce55433d81ea1c921
SHA256

d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c
SHA512

5ce8183b897ab5c7cfd709ace8e72880a437f641d26a6bafbab0639cfd6a72e45c36eb3f0fd8bc7ab1680f32f6bd06ae28377260fc7486d4741084253c41e343
SSDEEP

6144:IdF0CcZGMEOAyp8Y9uZ6IyNoGb7OhU6UO4yXnDdxD6qGKWr4PxQZDFZ:fZeKkvUXyXBMFrexe

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26
PID 1764 wrote to memory of 2028	1764	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d793cde87ebab5c56781a4969218e3d600d01638d1a34629515534189abf0c8c.dll,#1
  2⤵
  PID:2028

memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x0000000074640000-0x0000000074688000-memory.dmp

Filesize
288KB

Download
memory/2028-57-0x0000000000190000-0x0000000000194000-memory.dmp

Filesize
16KB

Download
memory/2028-58-0x00000000001F0000-0x0000000000215000-memory.dmp

Filesize
148KB

Download