97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817

Analysis

max time kernel
14s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 16:50

Target

97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817.dll
Size

52KB
MD5

5bee197b6cb8030114b9120a365e475a
SHA1

a95c67d2907be44738699fcd3bc0be2486d985ab
SHA256

97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817
SHA512

9740335eb7d3d704bb9eca9e2a95b6b0be6bbbe9c02a89c43d8633d546e89c09c82324361071b7aa29d553c1503fb1c079d50dfeb21dfd26b89bcb6ff4572e46
SSDEEP

1536:OBRVgrExucMlPoBU2hHIBWun78tTj0apKj:ERRs7LBHSTJS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28
PID 1560 wrote to memory of 1348	1560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97fa3d2ad1220300e2b44d196c05363dbe8bfe6ce40f1e043f142f0e8b167817.dll,#1
  2⤵
  PID:1348

memory/1348-54-0x0000000000000000-mapping.dmp

Download
memory/1348-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download