d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953

Analysis

max time kernel
18s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:17

Target

d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953.dll
Size

160KB
MD5

13ab8a1c23b7946690631ac1fb667b51
SHA1

b7174cc234dc1bfb1ef05cbf73d5cec6d73ae16d
SHA256

d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953
SHA512

b16494274339716cfcca2fbed425e66fad516478a0acd39b69533c8ba7aed8176854c072731a83b818e0ac616919729c487cde09469f26100445c0bd41849cfa
SSDEEP

3072:kYpAxlaoK3MILMtZlEj1HAmsmI8nYgD5L5sbAnk2b6f:kYpOAtcILMtojtAcn/5L5nXb

Score

1^/10

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1628 wrote to memory of 1988	1628	rundll32.exe	28
PID 1988 wrote to memory of 1312	1988	rundll32.exe	29
PID 1988 wrote to memory of 1312	1988	rundll32.exe	29
PID 1988 wrote to memory of 1312	1988	rundll32.exe	29
PID 1988 wrote to memory of 1312	1988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7ef2f14a36041a58e91e2dc66539f1e2250af6c3c2f6f62c539c193f6262953.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1312

memory/1988-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1988-57-0x00000000006BC000-0x00000000006DC000-memory.dmp

Filesize
128KB

Download