db2442177d2db5119935d994a778929fec4f490d7109e7a97b37143a9e1ad2e9

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:11

Target

db2442177d2db5119935d994a778929fec4f490d7109e7a97b37143a9e1ad2e9.dll
Size

32KB
MD5

5cd77ac9d722665c663af4fd3539ca10
SHA1

e68ce8af20df218662ceaea433bdc9e253c85dc6
SHA256

db2442177d2db5119935d994a778929fec4f490d7109e7a97b37143a9e1ad2e9
SHA512

b1ea88745ddf2ae21f6980b7dd1cdda334a08f1a9c714890b37476cf44ccfe7460e60fc1a987e4581df778721a9d5997f176ba26ba494ef841748e4772270785
SSDEEP

384:B3Djv9NYwKEZwAETtPR9eLi4bpA5E77qDE7h70prlawgJFJfegYCRLnJ:B3fGMXaILzb+E7qEF70NlhCDWglR7J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27
PID 1996 wrote to memory of 2012	1996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\db2442177d2db5119935d994a778929fec4f490d7109e7a97b37143a9e1ad2e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\db2442177d2db5119935d994a778929fec4f490d7109e7a97b37143a9e1ad2e9.dll,#1
  2⤵
  PID:2012

memory/2012-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download