4133076ebc3bf3b4a8bf0270b3375717de6fd754f8113da059c230c40a8f4440

Analysis

max time kernel
38s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:17

Target

4133076ebc3bf3b4a8bf0270b3375717de6fd754f8113da059c230c40a8f4440.dll
Size

411KB
MD5

e96478d0a9de1e0a4b29f323affe9b05
SHA1

2376d212751869029a2aea357ec02862e37f9a7a
SHA256

4133076ebc3bf3b4a8bf0270b3375717de6fd754f8113da059c230c40a8f4440
SHA512

ac919ed61b3c237f313f2fde9b12eb748861104b8e56e21a93283590fea142a764761ea3e125e9e610446b22d959a94258f8df33c3edbb9bb4f4abba1212f356
SSDEEP

12288:7pRpAgjH4MDsZVRGMBKUCGo0AY58KoEPL9n6N:VRpAgL3s/BKUPAO8EP2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 308	1472	rundll32.exe	28
PID 1472 wrote to memory of 308	1472	rundll32.exe	28
PID 1472 wrote to memory of 308	1472	rundll32.exe	28
PID 1472 wrote to memory of 308	1472	rundll32.exe	28
PID 1472 wrote to memory of 308	1472	rundll32.exe	28
PID 1472 wrote to memory of 308	1472	rundll32.exe	28
PID 1472 wrote to memory of 308	1472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4133076ebc3bf3b4a8bf0270b3375717de6fd754f8113da059c230c40a8f4440.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4133076ebc3bf3b4a8bf0270b3375717de6fd754f8113da059c230c40a8f4440.dll,#1
  2⤵
  PID:308

memory/308-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/308-56-0x0000000001C80000-0x0000000001D5E000-memory.dmp

Filesize
888KB

Download