b49281032ba743ef076074e6813b1a328a5497bd016a459397cdd456c9678c5e

Analysis

max time kernel
24s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:58

Target

b49281032ba743ef076074e6813b1a328a5497bd016a459397cdd456c9678c5e.dll
Size

163KB
MD5

4d633e15b40383a9e805cbcc104f5704
SHA1

6565aa10707dd04da241efc1158a960fa99b38f9
SHA256

b49281032ba743ef076074e6813b1a328a5497bd016a459397cdd456c9678c5e
SHA512

96834b13c00a2cec9d4f4c0bb8eee9f0bd4e7bed572c354dd9954d96fd8f4851666c693da2a475a87b3e61b95902421b0d4584347ea2dfdb1944a535d8bc2f4a
SSDEEP

3072:6eNqgvID+1Yw35EmznL3WNfQpm18lVI6mNS8b5rQOBPaawkZ6y:D1ID+1YmEmznL3U4y8/eN7b5rnBPatER

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27
PID 908 wrote to memory of 1636	908	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b49281032ba743ef076074e6813b1a328a5497bd016a459397cdd456c9678c5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b49281032ba743ef076074e6813b1a328a5497bd016a459397cdd456c9678c5e.dll,#1
  2⤵
  PID:1636

memory/1636-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1636-56-0x0000000000390000-0x0000000000431000-memory.dmp

Filesize
644KB

Download