cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769

Analysis

max time kernel
22s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:58

Target

cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769.dll
Size

57KB
MD5

b309532c5f731007fbb19dcce80d0512
SHA1

8d8d2f7636422a0e5f3d28a397b3981cb7a04088
SHA256

cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769
SHA512

e4aa43b3f9467d9e1f48690d09deb54676c5183ebe8deffa467f08a0056349b3d7857e2d6a9e1706274f955d7f6cce2eff34232864ab4e8faa118cafadb02561
SSDEEP

1536:lNIKDP4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:QqP4YU6ErtGNEKIpCT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28
PID 1756 wrote to memory of 1992	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc811f0984a0bd53350f0cdf90ba45eea06d1d3170d2df5df840c542a1e23769.dll,#1
  2⤵
  PID:1992

memory/1992-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download